Vulnerability · Published Feb 3, 2026 · Assigned by GitHub_M

CVE-2026-25150Prototype Pollution via FormData Processing in Qwik City

Critical 9.3

In plain English

A critical-severity prototype pollution in qwik from QwikDev. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 54% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)9.3Critical

Exploit odds (30 days)0.7%top 45.9% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Qwik is a performance focused javascript framework. Prior to version 1.19.0, a prototype pollution vulnerability exists in the formToObj() function within @builder.io/qwik-city middleware. The function processes form field names with dot notation (e.g., user.name) to create nested objects, but fails to sanitize dangerous property names like __proto__, constructor, and prototype. This allows unauthenticated attackers to pollute Object.prototype by sending crafted HTTP POST requests, potentially leading to privilege escalation, authentication bypass, or denial of service. This issue has been patched in version 1.19.0.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
npm	@builder.io/qwik-city	1.19.0	GHSA-xqg6-98cw-gxhq

Affected products (as reported)

Vendor	Product	Versions
QwikDev	qwik	< 1.19.0

Weakness: CWE-1321 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:L

References

https://github.com/QwikDev/qwik/security/advisories/GHSA-xqg6-98cw-gxhq x_refsource_CONFIRM
https://github.com/QwikDev/qwik/commit/5f65bae2bc33e6ca0c21e4cfcf9eae05077716f7 x_refsource_MISC