cve.bz

CVE-2026-25155

7.1 highEPSS 0.1%

High (7.1) in qwik qwik. EPSS 0.1% chance of exploitation in the next 30 days. Fixed in @builder.io/qwik-city 1.12.0.

Qwik is a performance focused javascript framework. Prior to version 1.12.0, a typo in the regular expression within isContentType causes incorrect parsing of certain Content-Type headers. This issue has been patched in version 1.12.0.

Severity

CVSS 3.1

7.1 high
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:N
EPSS
0.1% chance of exploitation in the next 30 days; higher than 3% of CVEs (scores of 2026-10-31)
CWE
CWE-352
Published
Modified
Record from
the NVD, synced

Affected

Packages (OSV)

AdvisoryEcosystemPackageAffectedFixed in
GHSA-vm6g-8r4h-22x8npm@builder.io/qwik-city<1.12.01.12.0

References

Check your stackJSON