CVE-2026-25155

Medium

Published: 03 February 2026

Published

03 February 2026

Modified

10 February 2026

KEV Added

—

Patch

—

CVSS Score 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:H/A:N

EPSS Score 0.0001 0.5th percentile

Risk Priority 12 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2026-25155 is a medium-severity CSRF (CWE-352) vulnerability in Qwik Qwik. Its CVSS base score is 5.9 (Medium).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 0.5th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

Threat & Defense at a Glance

What attackers do: exploitation maps to Exploit Public-Facing Application (T1190) and 1 other technique.

Threat & Defense Details

Likely Mitigating ControlsAI

Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.

AT-2 Literacy Training and Awareness

addresses: CWE-352

Awareness training educates users on avoiding untrusted links and actions that can be exploited via CSRF.

IA-11 Re-authentication

addresses: CWE-352

Requiring user re-entry of credentials for sensitive actions prevents automated forgery of requests without active user participation.

PM-14 Testing, Training, and Monitoring

addresses: CWE-352

Security testing regimens explicitly include checks for missing or ineffective anti-CSRF protections in web applications.

SI-4 System Monitoring

addresses: CWE-352

Detects anomalous request patterns consistent with cross-site request forgery.

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.

attack.mitre.org →

T1204.001 Malicious Link Execution

An adversary may rely upon a user clicking a malicious link in order to gain execution.

attack.mitre.org →

Why these techniques?

CSRF due to Content-Type parsing flaw in public web framework enables remote exploitation of apps (T1190) via malicious link requiring user interaction (T1204.001).

Confidence: MEDIUM · MITRE ATT&CK Enterprise v18.1

NVD Description

Qwik is a performance focused javascript framework. Prior to version 1.12.0, a typo in the regular expression within isContentType causes incorrect parsing of certain Content-Type headers. This issue has been patched in version 1.12.0.

Deeper analysisAI

CVE-2026-25155 affects Qwik, a performance-focused JavaScript framework, in versions prior to 1.12.0. The vulnerability stems from a typo in the regular expression used within the isContentType function, leading to incorrect parsing of certain Content-Type headers. This issue is classified under CWE-352 and carries a CVSS v3.1 base score of 5.9 (AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:H/A:N).

An unauthenticated remote attacker can exploit this vulnerability over the network, though it requires high attack complexity and user interaction. Successful exploitation enables limited confidentiality impact alongside high integrity impact, potentially allowing manipulation of request handling due to the misparsed Content-Type headers.

The Qwik security advisory (GHSA-vm6g-8r4h-22x8) and associated patch commit (d70d7099b90b998f1aac7cedc21c67d87bac4c75) confirm that the issue has been addressed in version 1.12.0, recommending an immediate upgrade to mitigate the flaw.