CVE-2026-32701

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-32701", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-03-13T14:33:42.823Z", "datePublished": "2026-03-20T08:52:41.149Z", "dateUpdated": "2026-03-20T12:07:39.151Z"}, "containers": {"cna": {"title": "Qwik has array method pollution in FormData processing, allowing type confusion and DoS", "problemTypes": [{"descriptions": [{"cweId": "CWE-843", "lang": "en", "description": "CWE-843: Access of Resource Using Incompatible Type ('Type Confusion')", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-1321", "lang": "en", "description": "CWE-1321: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}}], "references": [{"name": "https://github.com/QwikDev/qwik/security/advisories/GHSA-whhv-gg5v-864r", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/QwikDev/qwik/security/advisories/GHSA-whhv-gg5v-864r"}, {"name": "https://github.com/QwikDev/qwik/commit/7b5867c3dd8925df9aa96c4296b1e95a4c2af87d", "tags": ["x_refsource_MISC"], "url": "https://github.com/QwikDev/qwik/commit/7b5867c3dd8925df9aa96c4296b1e95a4c2af87d"}], "affected": [{"vendor": "QwikDev", "product": "qwik", "versions": [{"version": "< 1.19.2", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-03-20T08:52:41.149Z"}, "descriptions": [{"lang": "en", "value": "Qwik is a performance-focused JavaScript framework. Versions prior to 1.19.2 improperly inferred arrays from dotted form field names during FormData parsing. By submitting mixed array-index and object-property keys for the same path, an attacker could cause user-controlled properties to be written onto values that application code expected to be arrays. When processing application/x-www-form-urlencoded or multipart/form-data requests, Qwik City converted dotted field names (e.g., items.0, items.1) into nested structures. If a path was interpreted as an array, additional attacker-supplied keys on that path\u2014such as items.toString, items.push, items.valueOf, or items.length\u2014could alter the resulting server-side value in unexpected ways, potentially leading to request handling failures, denial of service through malformed array state or oversized lengths, and type confusion in downstream code. This issue was fixed in version 1.19.2."}], "source": {"advisory": "GHSA-whhv-gg5v-864r", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-03-20T12:07:03.359174Z", "id": "CVE-2026-32701", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-20T12:07:39.151Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-32701", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-03-20T12:07:03.359174Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-20T12:07:11.258Z"}}], "cna": {"title": "Qwik has array method pollution in FormData processing, allowing type confusion and DoS", "source": {"advisory": "GHSA-whhv-gg5v-864r", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}], "affected": [{"vendor": "QwikDev", "product": "qwik", "versions": [{"status": "affected", "version": "< 1.19.2"}]}], "references": [{"url": "https://github.com/QwikDev/qwik/security/advisories/GHSA-whhv-gg5v-864r", "name": "https://github.com/QwikDev/qwik/security/advisories/GHSA-whhv-gg5v-864r", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/QwikDev/qwik/commit/7b5867c3dd8925df9aa96c4296b1e95a4c2af87d", "name": "https://github.com/QwikDev/qwik/commit/7b5867c3dd8925df9aa96c4296b1e95a4c2af87d", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Qwik is a performance-focused JavaScript framework. Versions prior to 1.19.2 improperly inferred arrays from dotted form field names during FormData parsing. By submitting mixed array-index and object-property keys for the same path, an attacker could cause user-controlled properties to be written onto values that application code expected to be arrays. When processing application/x-www-form-urlencoded or multipart/form-data requests, Qwik City converted dotted field names (e.g., items.0, items.1) into nested structures. If a path was interpreted as an array, additional attacker-supplied keys on that path\u2014such as items.toString, items.push, items.valueOf, or items.length\u2014could alter the resulting server-side value in unexpected ways, potentially leading to request handling failures, denial of service through malformed array state or oversized lengths, and type confusion in downstream code. This issue was fixed in version 1.19.2."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-843", "description": "CWE-843: Access of Resource Using Incompatible Type ('Type Confusion')"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-1321", "description": "CWE-1321: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-03-20T08:52:41.149Z"}}}, "cveMetadata": {"cveId": "CVE-2026-32701", "state": "PUBLISHED", "dateUpdated": "2026-03-20T12:07:39.151Z", "dateReserved": "2026-03-13T14:33:42.823Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-03-20T08:52:41.149Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "qwik", "vendor": "QwikDev", "versions": [{"status": "affected", "version": "< 1.19.2"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:qwik:qwik:*:*:*:*:*:node.js:*:*", "matchCriteriaId": "EF7EC6DC-930F-497B-BAA2-E236F71CE7CB", "versionEndExcluding": "1.19.2", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Qwik is a performance-focused JavaScript framework. Versions prior to 1.19.2 improperly inferred arrays from dotted form field names during FormData parsing. By submitting mixed array-index and object-property keys for the same path, an attacker could cause user-controlled properties to be written onto values that application code expected to be arrays. When processing application/x-www-form-urlencoded or multipart/form-data requests, Qwik City converted dotted field names (e.g., items.0, items.1) into nested structures. If a path was interpreted as an array, additional attacker-supplied keys on that path\u2014such as items.toString, items.push, items.valueOf, or items.length\u2014could alter the resulting server-side value in unexpected ways, potentially leading to request handling failures, denial of service through malformed array state or oversized lengths, and type confusion in downstream code. This issue was fixed in version 1.19.2."}, {"lang": "es", "value": "Qwik es un framework de JavaScript centrado en el rendimiento. Las versiones anteriores a la 1.19.2 infer\u00edan incorrectamente arrays a partir de nombres de campos de formulario con puntos durante el an\u00e1lisis de FormData. Al enviar claves de \u00edndice de array y de propiedad de objeto mezcladas para la misma ruta, un atacante podr\u00eda hacer que las propiedades controladas por el usuario se escribieran sobre valores que el c\u00f3digo de la aplicaci\u00f3n esperaba que fueran arrays. Al procesar solicitudes application/x-www-form-urlencoded o multipart/form-data, Qwik City convert\u00eda los nombres de campo con puntos (p. ej., items.0, items.1) en estructuras anidadas. Si una ruta se interpretaba como un array, claves adicionales proporcionadas por el atacante en esa ruta \u2014como items.toString, items.push, items.valueOf o items.length\u2014 podr\u00edan alterar el valor resultante del lado del servidor de formas inesperadas, lo que podr\u00eda llevar a fallos en el manejo de solicitudes, denegaci\u00f3n de servicio a trav\u00e9s de un estado de array malformado o longitudes excesivas, y confusi\u00f3n de tipos en el c\u00f3digo subsiguiente. Este problema se solucion\u00f3 en la versi\u00f3n 1.19.2."}], "id": "CVE-2026-32701", "lastModified": "2026-06-17T10:36:14.017", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-32701", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-03-20T12:07:03.359174Z", "version": "2.0.3"}}]}, "published": "2026-03-20T09:16:14.520", "references": [{"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/QwikDev/qwik/commit/7b5867c3dd8925df9aa96c4296b1e95a4c2af87d"}, {"source": "security-advisories@github.com", "tags": ["Mitigation", "Vendor Advisory"], "url": "https://github.com/QwikDev/qwik/security/advisories/GHSA-whhv-gg5v-864r"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-843"}, {"lang": "en", "value": "CWE-1321"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,1.19.2)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "qwik", "source": "cna", "vendor": "QwikDev"}, "product": "qwik", "vendor": "qwikdev"}], "analysis": {"en": {"generated_at": "2026-03-23T16:52:19.281335+00:00", "value": {"mitigation_remediation": ["Upgrade Qwik to version\u202f1.19.2 or later.", "If an upgrade is not immediately possible, validate and sanitize incoming form data to reject mixed array\u2011index and object\u2011property keys on the same path.", "Apply strict server\u2011side type checks on any data structures that originate from form inputs to guard against unexpected type coercion.", "Monitor application logs for unusual request patterns that include keys such as items.toString, items.push, or items.length."], "summary": {"action": "Immediate Patch", "impact": "Denial of Service via type confusion"}, "threat_synthesis": {"affected_systems": "The vulnerability affects QwikDev\u2019s Qwik framework. Any installation of Qwik prior to version\u202f1.19.2 is vulnerable. Qwik is commonly used in Node.js\u2011based server or edge rendering contexts, so any deployment that processes form data through this framework is at risk. The issue was addressed in commit\u202f7b5867c3dd8925df9aa96c4296b1e95a4c2af87d and is fixed in version\u202f1.19.2 and later releases.", "description_and_impact": "Qwik transforms dotted form field names into nested structures when parsing application/x\u2011form\u2011urlencoded or multipart/form\u2011data. Before version\u202f1.19.2 it treated any path that included an index as an array, regardless of whether additional non\u2011index keys were present on the same path. An attacker could submit a mix of index keys (e.g., items.0, items.1) and object\u2011property keys (e.g., items.toString, items.push, items.length). Because the framework expected an array, it overwrote array elements with these user\u2011controlled properties, causing the resulting value to no longer be an array. This leads to type confusion and is what CWE\u20111321 describes\u2014manipulation of object properties to break expected invariants\u2014and CWE\u2011843, which concerns improper type conversion allowing malicious input to be treated as a different type.", "risk_and_exploitability": "CVSS score\u202f7.5 indicates moderate\u2011to\u2011high severity, but the EPSS score is under\u202f1\u202f%, suggesting current exploitation in the wild is unlikely. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires an attacker to craft a web request containing malformed form\u2011data or URL\u2011encoded payload that mixes array indices with object\u2011property keys on the same field name. If input validation is absent, the altered data can cause request handlers to fail, terminate prematurely, or allocate excessive memory, which can be leveraged for a denial\u2011of\u2011service attack or to destabilize downstream business logic."}}}}, "created": "2026-03-20T10:36:30.262462+00:00", "updated": "2026-03-25T14:29:46.405747+00:00", "vendors": ["qwikdev", "qwikdev$PRODUCT$qwik"]}