CVE-2026-25151: Qwik Framework CSRF Vulnerability

CVE-2026-25151 Overview

CVE-2026-25151 is a Cross-Site Request Forgery (CSRF) protection bypass vulnerability affecting Qwik, a performance-focused JavaScript framework. The vulnerability exists in Qwik City's server-side request handler, which inconsistently interprets HTTP request headers. A remote attacker can exploit this flaw to circumvent form submission CSRF protections by crafting specially formatted or multi-valued Content-Type headers.

Critical Impact
Attackers can bypass CSRF protections to perform unauthorized actions on behalf of authenticated users, potentially leading to account compromise, data manipulation, or privilege escalation.

Affected Products

Qwik versions prior to 1.19.0
Qwik City middleware request handler
Applications using Qwik City's built-in CSRF protection mechanisms

Discovery Timeline

2026-02-03 - CVE-2026-25151 published to NVD
2026-02-04 - Last updated in NVD database

Technical Details for CVE-2026-25151

Vulnerability Analysis

This vulnerability stems from inconsistent Content-Type header parsing in Qwik City's CSRF protection middleware. The original implementation checked for "simple request" content types (application/x-www-form-urlencoded, multipart/form-data, text/plain) to determine whether to enforce CSRF origin validation. However, the parsing logic could be manipulated through specially crafted Content-Type headers, allowing attackers to bypass the protection entirely.

The flaw is classified under CWE-352 (Cross-Site Request Forgery), where the web application does not sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.

Root Cause

The root cause lies in the checkCSRF function within resolve-request-handlers.ts. The original implementation only applied CSRF checks when a form-based Content-Type was detected. This logic failed to account for scenarios where:

No Content-Type header is present
Malformed or multi-valued Content-Type headers are submitted
Content-Type headers with additional parameters or unusual formatting bypass the simple check

The fix addresses this by inverting the logic—now treating requests without a Content-Type header, or with "simple request" content types, as requiring CSRF validation.

Attack Vector

The attack is network-based and requires user interaction (the victim must visit a malicious page while authenticated). An attacker can craft a malicious webpage that submits a forged request to the vulnerable Qwik application. By manipulating the Content-Type header in ways that bypass the original parsing logic, the attacker can make requests that evade CSRF protection while still being processed by the server.

typescript

// Security patch in resolve-request-handlers.ts
// Source: https://github.com/QwikDev/qwik/commit/eebf610e04cc3a690f11e10191d09ff0fca1c7ed

 function csrfCheckMiddleware(requestEv: RequestEvent) {
   checkCSRF(requestEv);
 }
-function checkCSRF(requestEv: RequestEvent, laxProto?: 'lax-proto') {
-  const isForm = isContentType(
-    requestEv.request.headers,
-    'application/x-www-form-urlencoded',
-    'multipart/form-data',
-    'text/plain'
-  );
-  if (isForm) {
+export function checkCSRF(requestEv: RequestEvent, laxProto?: 'lax-proto') {
+  const contentType = requestEv.request.headers.get('content-type');
+
+  const isSimpleRequest =
+    !contentType ||
+    isContentType(
+      requestEv.request.headers,
+      'application/x-www-form-urlencoded',
+      'multipart/form-data',
+      'text/plain'
+    );
+
+  if (isSimpleRequest) {
     const inputOrigin = requestEv.request.headers.get('origin');
     const origin = requestEv.url.origin;
     let forbidden = inputOrigin !== origin;

Detection Methods for CVE-2026-25151

Indicators of Compromise

Unusual HTTP requests with missing or malformed Content-Type headers targeting form submission endpoints
Requests with multi-valued Content-Type headers in server access logs
Cross-origin requests to state-changing endpoints that bypass normal CSRF token validation
Increased form submissions from unexpected referrers or without proper Origin headers

Detection Strategies

Monitor web server logs for requests with unusual Content-Type header patterns, including empty values, multiple values, or unexpected parameters
Implement Web Application Firewall (WAF) rules to detect and alert on malformed Content-Type headers
Review authentication logs for suspicious account activity that may indicate successful CSRF exploitation
Deploy anomaly detection on form submission endpoints to identify unusual request patterns

Monitoring Recommendations

Enable verbose logging for the Qwik City request handler middleware to capture Content-Type header values
Set up alerts for state-changing requests that originate from unexpected origins
Monitor for exploitation attempts by tracking requests with missing or null Content-Type headers to sensitive endpoints
Implement request integrity monitoring to detect potential CSRF attack patterns

How to Mitigate CVE-2026-25151

Immediate Actions Required

Upgrade Qwik to version 1.19.0 or later immediately
Audit application logs for any suspicious activity that may indicate prior exploitation
Review any custom CSRF protection implementations that may have similar Content-Type parsing issues
Consider implementing additional defense-in-depth measures such as SameSite cookies

Patch Information

The vulnerability has been patched in Qwik version 1.19.0. The fix modifies the checkCSRF function to properly handle edge cases in Content-Type header parsing. The patch ensures CSRF validation is applied to all "simple requests" as defined by CORS, including requests without a Content-Type header. For detailed patch information, see the GitHub Commit and GitHub Security Advisory.

Workarounds

If immediate upgrade is not possible, implement additional server-side CSRF token validation independent of Qwik City's built-in protection
Deploy a reverse proxy or WAF rule to normalize Content-Type headers before they reach the application
Implement strict SameSite cookie attributes (SameSite=Strict or SameSite=Lax) to provide defense-in-depth against CSRF attacks
Add custom middleware to explicitly validate Origin headers for all state-changing requests

bash

# Update Qwik to patched version
npm update @builder.io/qwik @builder.io/qwik-city

# Or install specific patched version
npm install @builder.io/qwik@1.19.0 @builder.io/qwik-city@1.19.0

# Verify installed version
npm list @builder.io/qwik