A typo in a regular expression used by Qwik’s CSRF protection middleware causes incorrect parsing of Content‑Type headers that contain parameters, such as multipart/form‑data. As a result, requests that would normally be rejected by the CSRF check can be accepted, allowing an attacker to perform unauthorized actions on behalf of an authenticated user. The weakness is a classic Cross‑Site Request Forgery (CWE‑352) flaw in request handling logic.

The vulnerability affects the Qwik JavaScript framework distributed by QwikDev. All versions of Qwik prior to 1.12.0 are impacted. The issue is fixed in Qwik 1.12.0 and later releases.

The CVSS base score is 5.9, indicating medium severity. EPSS is less than 1%, pointing to a low probability of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog, further suggesting limited exploitation. The likely attack vector requires an attacker to successfully craft a cross‑site request that targets a state‑changing endpoint and includes a Content‑Type header with parameters; successful exploitation would allow the attacker to execute actions without the victim’s consent.