CVE-2026-25151: Qwik

Medium severity, CVSS 5.9. EPSS: 0.2% chance of exploitation in the next 30 days.

Qwik is a performance focused javascript framework. Prior to version 1.19.0, Qwik City’s server-side request handler inconsistently interprets HTTP request headers, which can be abused by a remote attacker to circumvent form submission CSRF protections using specially crafted or multi-valued Content-Type headers. This issue has been patched in version 1.19.0.

Affected products

• Qwik Qwik: before 1.19.0 (fixed in 1.19.0)

Published 2026-02-03. Last modified 2026-06-17.