{"action":"Upgrade @builder.io/qwik-city to 1.12.0 or later.","affected":[{"fixed":"1.12.0","introduced":"0"}],"component":"@builder.io/qwik-city","cve_ids":["CVE-2026-25155"],"ecosystem":"npm","epss":0.00149,"exploited":false,"fixed_versions":["1.12.0"],"ghsa_id":"GHSA-vm6g-8r4h-22x8","id":"tcs_01M5KGC9NGQEJ8TSMB2ERNQRCR","modified_at":"2026-02-11T15:03:51.313099Z","published_at":"2026-02-03T20:59:18Z","references":["https://osv.dev/vulnerability/GHSA-vm6g-8r4h-22x8","https://github.com/QwikDev/qwik/security/advisories/GHSA-vm6g-8r4h-22x8","https://nvd.nist.gov/vuln/detail/CVE-2026-25155","https://github.com/QwikDev/qwik/commit/d70d7099b90b998f1aac7cedc21c67d87bac4c75","https://github.com/QwikDev/qwik"],"severity":{"label":"medium","score":5.9},"sources":[{"source":"osv","source_id":"GHSA-vm6g-8r4h-22x8","url":"https://osv.dev/vulnerability/GHSA-vm6g-8r4h-22x8"}],"summary":"Qwik City CSRF protection middleware does not work properly for content type header with parameters (eg. multipart/form-data)"}