{"action":"Upgrade @builder.io/qwik-city to 1.19.2 or later.","affected":[{"fixed":"1.19.2","introduced":"0"}],"component":"@builder.io/qwik-city","cve_ids":["CVE-2026-32701"],"ecosystem":"npm","epss":0.00587,"exploited":false,"fixed_versions":["1.19.2"],"ghsa_id":"GHSA-whhv-gg5v-864r","id":"tcs_01M5KGF51QQJSJF2HG4DET59EC","modified_at":"2026-03-20T16:11:21.822051Z","published_at":"2026-03-20T15:56:44Z","references":["https://osv.dev/vulnerability/GHSA-whhv-gg5v-864r","https://github.com/QwikDev/qwik/security/advisories/GHSA-whhv-gg5v-864r","https://nvd.nist.gov/vuln/detail/CVE-2026-32701","https://github.com/QwikDev/qwik/commit/7b5867c3dd8925df9aa96c4296b1e95a4c2af87d","https://github.com/QwikDev/qwik"],"severity":{"label":"high","score":7.5},"sources":[{"source":"osv","source_id":"GHSA-whhv-gg5v-864r","url":"https://osv.dev/vulnerability/GHSA-whhv-gg5v-864r"}],"summary":"Qwik City has array method pollution in FormData processing allows type confusion and DoS"}