Vulnerability · Published Feb 3, 2026 · Assigned by GitHub_M

CVE-2026-25149Qwik City Open Redirect via fixTrailingSlash

Low 2.7

In plain English

A low-severity open redirect in qwik from QwikDev. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 19% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 4.0)2.7Low

Exploit odds (30 days)0.3%top 80.8% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Qwik is a performance focused javascript framework. Prior to version 1.19.0, an Open Redirect vulnerability in Qwik City's default request handler middleware allows a remote attacker to redirect users to arbitrary protocol-relative URLs. Successful exploitation permits attackers to craft convincing phishing links that appear to originate from the trusted domain but redirect the victim to an attacker-controlled site. This issue has been patched in version 1.19.0.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
npm	@builder.io/qwik-city	1.19.0	GHSA-92j7-wgmg-f32m

Affected products (as reported)

Vendor	Product	Versions
QwikDev	qwik	< 1.19.0

Weakness: CWE-601 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:L/E:U

References

https://github.com/QwikDev/qwik/security/advisories/GHSA-92j7-wgmg-f32m x_refsource_CONFIRM
https://github.com/QwikDev/qwik/commit/9959eab30a3ad9cc03689eaa080fcfbc33df71ed x_refsource_MISC