CVE Intelligence
Analysis AI-assisted

CVE-2026-25150: Qwik Prototype Pollution in qwik-city formToObj() Middleware

CVE-2026-25150 is a prototype pollution flaw (CWE-1321) in the formToObj() function of the @builder.io/qwik-city middleware in Qwik versions before 1.19.0. The record states that unauthenticated attackers may reach it through crafted HTTP POST requests, with possible consequences including privilege escalation, authentication bypass or denial of service. The issue is patched in 1.19.0, and the record does not list it in CISA KEV.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

Qwik is a JavaScript framework focused on performance. According to the record, versions before 1.19.0 of the @builder.io/qwik-city middleware contain a prototype pollution flaw (CWE-1321) in the formToObj() function. The function builds nested objects from form field names written in dot notation but does not filter dangerous property names such as __proto__, constructor and prototype.

Impact

  • According to the record, an unauthenticated remote attacker may be able to modify Object.prototype by sending crafted HTTP POST requests.
  • The record lists possible consequences of privilege escalation, authentication bypass and denial of service.
  • NVD scores the issue 10.0 (Critical) under CVSS 3.1 with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H. GitHub assigns 9.3 under CVSS 3.1.

Affected products and versions

  • The record lists the product as Qwik, versions before 1.19.0.
  • The record identifies 1.19.0 as the patched version.
  • Whether other packages in the Qwik ecosystem are affected is unknown from the record.

Exploitation status

The record shows CVE-2026-25150 is not listed in CISA KEV, and no confirmed active exploitation appears in the sources consulted. The record contains no EPSS data.

Remediation and mitigation

  • Upgrade the Qwik framework, including the qwik-city middleware, to version 1.19.0 or later.
  • Review the patch commit referenced in the record to understand the change.
  • If an immediate upgrade is not possible, the record does not describe a vetted workaround, so any interim mitigation is unknown and should be confirmed with the vendor.
  • Inventory applications that use Qwik City form handling to prioritize updates.

Detection guidance

  • Review web server and application logs for POST requests whose form field names contain dot-notation segments such as __proto__, constructor or prototype.
  • Monitor for unexpected application behavior, such as altered default object properties or authorization anomalies.
  • These are high-level indicators only. The record does not provide signatures.

Limitations of the available information

  • The record does not include the full advisory text or details about exploitation.
  • The CVSS scores from NVD (10.0) and GitHub (9.3) differ, and the record does not resolve which one applies.
  • Whether a given application is reachable depends on its use of formToObj(). This is an inference, not a confirmed fact.

Frequently asked questions

Which versions of Qwik are affected by CVE-2026-25150?

According to the record, versions before 1.19.0 are affected, and 1.19.0 is the patched version.

Is CVE-2026-25150 being actively exploited?

The record shows the CVE is not listed in CISA KEV, and no confirmed active exploitation appears in the sources consulted.

What should administrators do first?

Identify applications using the Qwik framework and qwik-city middleware, then upgrade to version 1.19.0 or later. The record does not describe a verified workaround for systems that cannot be upgraded right away.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.