TI-2026-20312 Aliases CVE-2026-25150 GHSA-xqg6-98cw-gxhq

Prototype Pollution via FormData Processing in Qwik City

MEDIUM 50CWE-1321Published 2026-02-03 · Updated 2026-02-04

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: —
Confidentiality · integrity · availability: High · High · High
Fix status: Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub.

Summary

Qwik is a performance focused javascript framework. Prior to version 1.19.0, a prototype pollution vulnerability exists in the formToObj() function within @builder.io/qwik-city middleware. The function processes form field names with dot notation (e.g., user.name) to create nested objects, but fails to sanitize dangerous property names like __proto__, constructor, and prototype. This allows unauthenticated attackers to pollute Object.prototype by sending crafted HTTP POST requests, potentially leading to privilege escalation, authentication bypass, or denial of service. This issue has been patched in version 1.19.0.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00719 54th percentileScored 2026-11-07

Fix Fixed qwik (QwikDev): 1.19.0@builder.io/qwik-city (npm): 1.19.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: Yes
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
QwikDev	qwik	before 1.19.0	1.19.0	Patch available	CNA
—	@builder.io/qwik-city (npm)	before 1.19.0	1.19.0	Patch available	GHSA-xqg6-98cw-gxhq

qwik VendorQwikDev Affected before 1.19.0 Fixed in 1.19.0 Patch available CNA
@builder.io/qwik-city (npm) Vendor— Affected before 1.19.0 Fixed in 1.19.0 Patch available GHSA-xqg6-98cw-gxhq

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:qwik:qwik::::::node.js::*	before 1.19.0	Vulnerable	QwikDev

cpe:2.3:a:qwik:qwik:*:*:*:*:*:node.js:*:* Versions before 1.19.0 Vulnerable ·QwikDev

Remediation

Fix · CNA qwik (QwikDev) Fixed in 1.19.0
Fix · GHSA-xqg6-98cw-gxhq @builder.io/qwik-city (npm) Fixed in 1.19.0 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2026-25150
2026-10-03 Alias added: GHSA-xqg6-98cw-gxhq

References

Patch 1

https://github.com/QwikDev/qwik/commit/5f65bae2bc33e6ca0c21e4cfcf9eae05077716f7

Advisory 2

Other 1

https://github.com/QwikDev/qwik

TI-2023-01211 Code Injection in builderio/qwik CVSS 3.1CRITICAL 10.0
TI-2023-02164 Cross-Site Request Forgery (CSRF) in builderio/qwik CVSS 3.1MEDIUM 6.5
TI-2024-27738 Cross-site Scripting (XSS) vulnerability due to improper HTML escaping in qwik CVSS 3.1MEDIUM 6.3
TI-2023-00388 Cross-site Scripting (XSS) - Generic in builderio/qwik CVSS 3.1MEDIUM 6.1
TI-2026-22314 Qwik affected by unauthenticated RCE via server$ Deserialization CVSS 4.0CRITICAL 9.2
TI-2026-25193 Qwik has array method pollution in FormData processing, allowing type confusion and DoS CVSS 3.1HIGH 7.5

See all 10 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences