TI-2026-25193 Aliases CVE-2026-32701 GHSA-whhv-gg5v-864r

Qwik has array method pollution in FormData processing, allowing type confusion and DoS

LOW 39CWE-1321Published 2026-03-20 · Updated 2026-03-20

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: Denial of service
Confidentiality · integrity · availability: None · None · High
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-843 and the CVSS impact.

Summary

Qwik is a performance-focused JavaScript framework. Versions prior to 1.19.2 improperly inferred arrays from dotted form field names during FormData parsing. By submitting mixed array-index and object-property keys for the same path, an attacker could cause user-controlled properties to be written onto values that application code expected to be arrays. When processing application/x-www-form-urlencoded or multipart/form-data requests, Qwik City converted dotted field names (e.g., items.0, items.1) into nested structures. If a path was interpreted as an array, additional attacker-supplied keys on that path—such as items.toString, items.push, items.valueOf, or items.length—could alter the resulting server-side value in unexpected ways, potentially leading to request handling failures, denial of service through malformed array state or oversized lengths, and type confusion in downstream code. This issue was fixed in version 1.19.2.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00452 39th percentileScored 2026-11-07

Fix Fixed qwik (QwikDev): 1.19.2@builder.io/qwik-city (npm): 1.19.2

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: Yes
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
QwikDev	qwik	before 1.19.2	1.19.2	Patch available	CNA
—	@builder.io/qwik-city (npm)	before 1.19.2	1.19.2	Patch available	GHSA-whhv-gg5v-864r

qwik VendorQwikDev Affected before 1.19.2 Fixed in 1.19.2 Patch available CNA
@builder.io/qwik-city (npm) Vendor— Affected before 1.19.2 Fixed in 1.19.2 Patch available GHSA-whhv-gg5v-864r

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:qwik:qwik::::::node.js::*	before 1.19.2	Vulnerable	QwikDev

cpe:2.3:a:qwik:qwik:*:*:*:*:*:node.js:*:* Versions before 1.19.2 Vulnerable ·QwikDev

Remediation

Fix · CNA qwik (QwikDev) Fixed in 1.19.2
Fix · GHSA-whhv-gg5v-864r @builder.io/qwik-city (npm) Fixed in 1.19.2 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2026-32701
2026-10-03 Alias added: GHSA-whhv-gg5v-864r
2026-10-18 Priority changed: LOW → MEDIUM
2026-10-25 Priority changed: MEDIUM → LOW

References

Patch 1

https://github.com/QwikDev/qwik/commit/7b5867c3dd8925df9aa96c4296b1e95a4c2af87d

Advisory 2

Other 1

https://github.com/QwikDev/qwik

TI-2023-01211 Code Injection in builderio/qwik CVSS 3.1CRITICAL 10.0
TI-2023-02164 Cross-Site Request Forgery (CSRF) in builderio/qwik CVSS 3.1MEDIUM 6.5
TI-2024-27738 Cross-site Scripting (XSS) vulnerability due to improper HTML escaping in qwik CVSS 3.1MEDIUM 6.3
TI-2023-00388 Cross-site Scripting (XSS) - Generic in builderio/qwik CVSS 3.1MEDIUM 6.1
TI-2026-22314 Qwik affected by unauthenticated RCE via server$ Deserialization CVSS 4.0CRITICAL 9.2
TI-2026-20312 Prototype Pollution via FormData Processing in Qwik City CVSS 3.1CRITICAL 10.0

See all 10 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences