Magic.

Magic is the weakness that surprises people most. Superman can shrug off a missile, but a spell can floor him. The reason is simple once you know where his toughness comes from.

Why is Superman weak to magic?

Superman’s invulnerability is physical: it comes from dense Kryptonian cells charged by Earth’s yellow sun. Magic doesn’t work on the physical level, so his defences don’t stop it. A spell, a curse or an enchanted blade affects him as it would an ordinary person. That’s why “weak to magic” is a slight simplification: magic doesn’t harm him more than anyone else, it just bypasses everything that normally protects him.

Wikipedia cites Superman #171 (1964) for the idea, but none of the explainers we checked names an agreed first story. Until a second source confirms it, treat #171 as a likely early example rather than the definite first.

Superman’s magical enemies

Mr. Mxyzptlk is the classic: he can bend reality, Superman can’t punch his way out, and the only way to send him home is to trick him into saying his name backwards. For the rest of the rogues gallery, see Superman’s villains.

Magic-made kryptonite

Magic and kryptonite have overlapped. Krimson kryptonite, created by magic, grants a single wish in Superman (vol. 2) #49 (November 1990). See every colour on kryptonite.

How magic compares with Superman’s other weaknesses

Magic is one of three outside forces that reliably get past Superman’s defences, alongside green kryptonite and red sunlight. Unlike those two, magic doesn’t remove his powers; he stays strong and fast, but anything magical can still hurt him. See the ranked list on Superman’s weaknesses and how his toughness works on invulnerability.