CVE-2026-32701

CVE-2026-32701 impacts Qwik framework versions prior to 1.19.2, where improper array inference during FormData parsing allows attackers to manipulate dotted form field names. This enables user-controlled properties to be written onto values expected to be arrays, leading to type confusion and potential denial of service. With a CVSS score of 7.5 (High), this vulnerability has a network attack vector, low complexity, requires no privileges or user interaction, and primarily impacts availability. There is currently no evidence of active exploitation, public exploit code, or significant community discussion for this issue. The vulnerability was addressed in Qwik version 1.19.2.