CVE-2026-25151

MediumCVSS 5.9/10Last modified Jun 17, 2026

Description

Qwik is a performance focused javascript framework. Prior to version 1.19.0, Qwik City’s server-side request handler inconsistently interprets HTTP request headers, which can be abused by a remote attacker to circumvent form submission CSRF protections using specially crafted or multi-valued Content-Type headers. This issue has been patched in version 1.19.0.

Metrics

CVSS 3.1 5.9/10CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:H/A:N

Weakness enumeration

CWE-352

Affected software

No affected versions have been published.

Timeline

Published: Feb 3, 2026
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-251526.5Backstage is an open framework for building developer portals, and @backstage/plugin-techdocs-node provides common node.js functionalities f CVE-2026-251538.8Backstage is an open framework for building developer portals, and @backstage/plugin-techdocs-node provides common node.js functionalities f CVE-2026-251546.1LocalSend is a free, open-source app that allows users to share files and messages with nearby devices over their local network without need CVE-2026-251557.1Qwik is a performance focused javascript framework. Prior to version 1.12.0, a typo in the regular expression within isContentType causes in CVE-2026-251566.3HotCRP is conference review software. HotCRP versions from October 2025 through January 2026 delivered documents of all types with inline Co CVE-2026-251577.5OpenClaw is a personal AI assistant. Prior to version 2026.1.29, there is an OS command injection vulnerability via the Project Root Path in CVE-2026-25167.0A vulnerability was identified in Unidocs ezPDF DRM Reader and ezPDF Reader 2.0/3.0.0.4. This affects an unknown part in the library SHFOLDE CVE-2026-251607.4Alist is a file list program that supports multiple storages, powered by Gin and Solidjs. Prior to version 3.57.0, the application disables CVE-2026-251618.8Alist is a file list program that supports multiple storages, powered by Gin and Solidjs. Prior to version 3.57.0, the application contains CVE-2026-251648.1OpenEMR is a free and open source electronic health records and medical practice management application. Prior to version 8.0.0, the REST AP CVE-2026-251657.8Null pointer dereference in Windows Performance Counters allows an authorized attacker to elevate privileges locally.CVE-2026-251667.8Deserialization of untrusted data in Windows System Image Manager allows an authorized attacker to execute code locally.