Qwik transforms dotted form field names into nested structures when parsing application/x‑form‑urlencoded or multipart/form‑data. Before version 1.19.2 it treated any path that included an index as an array, regardless of whether additional non‑index keys were present on the same path. An attacker could submit a mix of index keys (e.g., items.0, items.1) and object‑property keys (e.g., items.toString, items.push, items.length). Because the framework expected an array, it overwrote array elements with these user‑controlled properties, causing the resulting value to no longer be an array. This leads to type confusion and is what CWE‑1321 describes—manipulation of object properties to break expected invariants—and CWE‑843, which concerns improper type conversion allowing malicious input to be treated as a different type.

The vulnerability affects QwikDev’s Qwik framework. Any installation of Qwik prior to version 1.19.2 is vulnerable. Qwik is commonly used in Node.js‑based server or edge rendering contexts, so any deployment that processes form data through this framework is at risk. The issue was addressed in commit 7b5867c3dd8925df9aa96c4296b1e95a4c2af87d and is fixed in version 1.19.2 and later releases.

CVSS score 7.5 indicates moderate‑to‑high severity, but the EPSS score is under 1 %, suggesting current exploitation in the wild is unlikely. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires an attacker to craft a web request containing malformed form‑data or URL‑encoded payload that mixes array indices with object‑property keys on the same field name. If input validation is absent, the altered data can cause request handlers to fail, terminate prematurely, or allocate excessive memory, which can be leveraged for a denial‑of‑service attack or to destabilize downstream business logic.