A flaw in Qwik City’s server‑side request handling allows an attacker to manipulate the Content‑Type header in such a way that the platform cannot reliably detect a legitimate form submission. This inconsistent interpretation can be exploited to bypass established CSRF protections and carry out unauthorized actions on behalf of an authenticated user. The vulnerability is specifically tied to a type of cross‑site request forgery weakness.

Qwik City implementations that use any QwikDev product prior to version 1.19.0 are vulnerable. The affected product – the Qwik framework – is distributed by QwikDev and is used in Node.js environments.

The CVSS score of 5.9 indicates a moderate risk, while the EPSS score of less than 1% shows a very low likelihood of exploitation at the time of analysis. The vulnerability is not listed in the CISA KEV catalog. Attackers can reach the vulnerable code remotely by crafting HTTP requests with aberrant or multi‑valued Content‑Type headers; no special network or system access is required beyond standard web traffic.