GHSA-whhv-gg5v-864r
High · 7.5CVSS
7.5
EPSS
—
Published
Mar 20, 2026
CISA due date
—
The record
Qwik City has array method pollution in FormData processing allows type confusion and DoS
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| npm | @builder.io/qwik-city | 0 | 1.19.2 |
Related vulnerabilities
- CVE-2026-32701 Qwik is a performance-focused JavaScript framework. Same vulnerability
- CVE-2026-25151 Qwik is a performance focused javascript framework. Also affects @builder.io/qwik-city
- CVE-2026-25148 Qwik is a performance focused javascript framework. Also affects @builder.io/qwik-city
- CVE-2026-25155 Qwik is a performance focused javascript framework. Also affects @builder.io/qwik-city
- CVE-2026-25150 Qwik is a performance focused javascript framework. Also affects @builder.io/qwik-city
- CVE-2026-25149 Qwik is a performance focused javascript framework. Also affects @builder.io/qwik-city
- GHSA-vm6g-8r4h-22x8 Qwik City CSRF protection middleware does not work properly for content type header with… Also affects @builder.io/qwik-city
- GHSA-92j7-wgmg-f32m Qwik City Open Redirect via fixTrailingSlash Also affects @builder.io/qwik-city