Detections
Analytics

SCA: security update for @builder.io/qwik-city (GHSA-whhv-gg5v-864r)

high Tenable Self-Hosted Container Security Plugin ID 439062

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - Qwik is a performance-focused JavaScript framework. Versions prior to 1.19.2 improperly inferred arrays
 from dotted form field names during FormData parsing. By submitting mixed array-index and object-property
 keys for the same path, an attacker could cause user-controlled properties to be written onto values that
 application code expected to be arrays. When processing application/x-www-form-urlencoded or
 multipart/form-data requests, Qwik City converted dotted field names (e.g., items.0, items.1) into nested
 structures. If a path was interpreted as an array, additional attacker-supplied keys on that path—such as
 items.toString, items.push, items.valueOf, or items.length—could alter the resulting server-side value in
 unexpected ways, potentially leading to request handling failures, denial of service through malformed
 array state or oversized lengths, and type confusion in downstream code. This issue was fixed in version
 1.19.2. (CVE-2026-32701)

Solution

Update the @builder.io/qwik-city library and its related packages to version 1.19.2 or later.

See Also

https://github.com/advisories/GHSA-whhv-gg5v-864r

Plugin Details

Severity: High

ID: 439062

Version: Revision 1.6

Type: Local

Family: SCA Checks

Published: 3/20/2026

Updated: 7/2/2026

Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Low

Score: 3

Percentile: 23.73

Vendor

Vendor Severity: High

CVSS v2

Risk Factor: High

Base Score: 7.8

Temporal Score: 5.8

Vector: CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:C

CVSS Score Source: CVE-2026-32701

CVSS v3

Risk Factor: High

Base Score: 7.5

Temporal Score: 6.5

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 3/20/2026

Vulnerability Publication Date: 3/20/2026

Reference Information

CVE: CVE-2026-32701

cwe: CWE-843