EUVD-2026-13639

Qwik City has array method pollution in FormData processing allows type confusion and DoS...

PT-2026-26593

Summary Qwik City improperly inferred arrays from dotted form field names during FormData parsing. By submitting mixed array-index and object-property keys for the same path, an attacker could cause user-controlled properties to be written onto values that application code expected to be arrays...