{"action":"Upgrade @builder.io/qwik-city to 1.19.0 or later.","affected":[{"fixed":"1.19.0","introduced":"0"}],"component":"@builder.io/qwik-city","cve_ids":["CVE-2026-25151"],"ecosystem":"npm","epss":0.00181,"exploited":false,"fixed_versions":["1.19.0"],"ghsa_id":"GHSA-r666-8gjf-4v5f","id":"tcs_01M5KG86XGJ8TJA8D30XR142X5","modified_at":"2026-02-04T18:08:22.625367Z","published_at":"2026-02-03T20:49:58Z","references":["https://osv.dev/vulnerability/GHSA-r666-8gjf-4v5f","https://github.com/QwikDev/qwik/security/advisories/GHSA-r666-8gjf-4v5f","https://nvd.nist.gov/vuln/detail/CVE-2026-25151","https://github.com/QwikDev/qwik/commit/eebf610e04cc3a690f11e10191d09ff0fca1c7ed","https://github.com/QwikDev/qwik"],"severity":{"label":"medium","score":5.9},"sources":[{"source":"osv","source_id":"GHSA-r666-8gjf-4v5f","url":"https://osv.dev/vulnerability/GHSA-r666-8gjf-4v5f"}],"summary":"Qwik City has a CSRF Protection Bypass via Content-Type Header Validation"}