Publish Advisories

GHSA-r666-8gjf-4v5f
GHSA-xqg6-98cw-gxhq

Author: advisory-database[bot]

advisories/github-reviewed/2026/02/GHSA-r666-8gjf-4v5f/GHSA-r666-8gjf-4v5f.json

@@ -0,0 +1,61 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-r666-8gjf-4v5f",
+  "modified": "2026-02-03T20:49:58Z",
+  "published": "2026-02-03T20:49:58Z",
+  "aliases": [
+    "CVE-2026-25151"
+  ],
+  "summary": "Qwik City has a CSRF Protection Bypass via Content-Type Header Validation",
+  "details": "### Summary\nQwik City’s server-side request handler inconsistently interprets HTTP request headers, which can be abused by a remote attacker to circumvent form submission CSRF protections using specially crafted or multi-valued Content-Type headers.\n\n### Impact\nA vulnerability in checkCSRF lets an attacker bypass Origin-based CSRF checks by using malformed or multi-valued Content-Type headers. Exploitation requires the CORS preflight to succeed (so it’s blocked if preflight is denied) and is possible when the application accepts cross-origin requests or via non-browser clients. Impact varies with server CORS and cookie policies and may enable unauthorized state changes.",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:H/A:N"
+    }
+  ],
+  "affected": [
+    {
+      "package": {
+        "ecosystem": "npm",
+        "name": "@builder.io/qwik-city"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "0"
+            },
+            {
+              "fixed": "1.19.0"
+            }
+          ]
+        }
+      ]
+    }
+  ],
+  "references": [
+    {
+      "type": "WEB",
+      "url": "https://github.com/QwikDev/qwik/security/advisories/GHSA-r666-8gjf-4v5f"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/QwikDev/qwik/commit/eebf610e04cc3a690f11e10191d09ff0fca1c7ed"
+    },
+    {
+      "type": "PACKAGE",
+      "url": "https://github.com/QwikDev/qwik"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-352"
+    ],
+    "severity": "MODERATE",
+    "github_reviewed": true,
+    "github_reviewed_at": "2026-02-03T20:49:58Z",
+    "nvd_published_at": null
+  }
+}

advisories/github-reviewed/2026/02/GHSA-xqg6-98cw-gxhq/GHSA-xqg6-98cw-gxhq.json

@@ -0,0 +1,61 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-xqg6-98cw-gxhq",
+  "modified": "2026-02-03T20:49:22Z",
+  "published": "2026-02-03T20:49:22Z",
+  "aliases": [
+    "CVE-2026-25150"
+  ],
+  "summary": "Prototype Pollution via FormData Processing in Qwik City",
+  "details": "### Summary\n\nA Prototype Pollution vulnerability exists in the `formToObj()` function within `@builder.io/qwik-city` middleware. The function processes form field names with dot notation (e.g., `user.name`) to create nested objects, but fails to sanitize dangerous property names like `__proto__`, `constructor`, and `prototype`. This allows unauthenticated attackers to pollute `Object.prototype` by sending crafted HTTP POST requests, potentially leading to privilege escalation, authentication bypass, or denial of service.\n\n### Impact\nAn unauthenticated attacker can supply specially crafted form field names that cause formToObj() to write dangerous keys (for example __proto__, constructor, prototype) into parsed objects. This results in Prototype Pollution of the server process and can cause privilege escalation, auth bypass, denial-of-service, or other global application integrity failures depending on how objects are used.",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:L"
+    }
+  ],
+  "affected": [
+    {
+      "package": {
+        "ecosystem": "npm",
+        "name": "@builder.io/qwik-city"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "0"
+            },
+            {
+              "fixed": "1.19.0"
+            }
+          ]
+        }
+      ]
+    }
+  ],
+  "references": [
+    {
+      "type": "WEB",
+      "url": "https://github.com/QwikDev/qwik/security/advisories/GHSA-xqg6-98cw-gxhq"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/QwikDev/qwik/commit/5f65bae2bc33e6ca0c21e4cfcf9eae05077716f7"
+    },
+    {
+      "type": "PACKAGE",
+      "url": "https://github.com/QwikDev/qwik"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-1321"
+    ],
+    "severity": "CRITICAL",
+    "github_reviewed": true,
+    "github_reviewed_at": "2026-02-03T20:49:22Z",
+    "nvd_published_at": null
+  }
+}