Cyber Resilience

CVE-2026-25155

Medium

Published: 03 February 2026

Published
03 February 2026
Modified
10 February 2026
KEV Added
—
Patch
—
CVSS Score v3.1 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:H/A:N
EPSS Score 0.0001 0.8th percentile
Risk Priority 12 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2026-25155 is a medium-severity CSRF (CWE-352) vulnerability in Qwik Qwik. Its CVSS base score is 5.9 (Medium).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 0.8th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).

Deeper analysis

CVE-2026-25155 affects Qwik, a performance-focused JavaScript framework, in versions prior to 1.12.0. The vulnerability stems from a typo in the regular expression used within the isContentType function, leading to incorrect parsing of certain Content-Type headers. This issue is classified under CWE-352 and carries a CVSS v3.1 base score of 5.9 (AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:H/A:N).

An unauthenticated remote attacker can exploit this vulnerability over the network, though it requires high attack complexity and user interaction. Successful exploitation enables limited confidentiality impact alongside high integrity impact, potentially allowing manipulation of request handling due to the misparsed Content-Type headers.

The Qwik security advisory (GHSA-vm6g-8r4h-22x8) and associated patch commit (d70d7099b90b998f1aac7cedc21c67d87bac4c75) confirm that the issue has been addressed in version 1.12.0, recommending an immediate upgrade to mitigate the flaw.

EU & UK References

Vulnerability details

Qwik is a performance focused javascript framework. Prior to version 1.12.0, a typo in the regular expression within isContentType causes incorrect parsing of certain Content-Type headers. This issue has been patched in version 1.12.0.

CWE(s)
CWE-352

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
T1204.001 Malicious Link Execution
An adversary may rely upon a user clicking a malicious link in order to gain execution.
attack.mitre.org →
Why these techniques?

CSRF due to Content-Type parsing flaw in public web framework enables remote exploitation of apps (T1190) via malicious link requiring user interaction (T1204.001).

Confidence: MEDIUM · MITRE ATT&CK Enterprise v18.1

CVEs Like This One

CVE-2026-27971Same product: Qwik Qwik
CVE-2026-25150Same product: Qwik Qwik
CVE-2026-32701Same product: Qwik Qwik
CVE-2025-25121Shared CWE-352
CVE-2025-24001Shared CWE-352
CVE-2025-25147Shared CWE-352
CVE-2026-34904Shared CWE-352
CVE-2024-26153Shared CWE-352
CVE-2025-28860Shared CWE-352
CVE-2026-45430Shared CWE-352

Affected Assets

qwik
qwik
≤ 1.12.0

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

SI-10 Information Input Validation good match
prevent

Directly requires validation of Content-Type headers to prevent the regex typo from causing incorrect request parsing that enables the CWE-352 bypass.

AC-4 Information Flow Enforcement partial match
prevent

Enforces information flow decisions based on properly parsed Content-Type attributes, blocking the header misinterpretation that leads to unauthorized request handling.

SI-2 Flaw Remediation good match
prevent

Mandates timely application of the vendor patch (v1.12.0) that corrects the isContentType regex flaw before exploitation.

References