CVE-2026-25150
published 2026-02-03CVE-2026-25150: Qwik is a performance focused javascript framework. Prior to version 1.19.0, a prototype pollution vulnerability exists in the formToObj() function within…
PriorityP270critical10CVSS 3.1
AVNACLPRNUINSCCHIHAH
EPSS
0.62%
45.4th percentile
Qwik is a performance focused javascript framework. Prior to version 1.19.0, a prototype pollution vulnerability exists in the formToObj() function within @builder.io/qwik-city middleware. The function processes form field names with dot notation (e.g., user.name) to create nested objects, but fails to sanitize dangerous property names like __proto__, constructor, and prototype. This allows unauthenticated attackers to pollute Object.prototype by sending crafted HTTP POST requests, potentially leading to privilege escalation, authentication bypass, or denial of service. This issue has been patched in version 1.19.0.
Affected
3 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| builder.io | qwik-city | >= 0 < 1.19.0 | 1.19.0 |
| qwik | qwik | < 1.19.0 | 1.19.0 |
| qwikdev | qwik | < 1.19.0 | 1.19.0 |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
Prototype Pollution via FormData Processing in Qwik City
ghsa·2026-02-03
CVE-2026-25150 [CRITICAL] CWE-1321 Prototype Pollution via FormData Processing in Qwik City
Prototype Pollution via FormData Processing in Qwik City
### Summary
A Prototype Pollution vulnerability exists in the `formToObj()` function within `@builder.io/qwik-city` middleware. The function processes form field names with dot notation (e.g., `user.name`) to create nested objects, but fails to sanitize dangerous property names like `__proto__`, `constructor`, and `prototype`. This allows unauthenticated attackers to pollute `Object.prototype` by sending crafted HTTP POST requests, potentially leading to privilege escalation, authentication bypass, or denial of service.
### Impact
An unauthenticated attacker can supply specially crafted form field names that cause formToObj() to write dangerous keys (for example __proto__, constructor, prototype) into parsed objects. This results
OSV
Prototype Pollution via FormData Processing in Qwik City
osv·2026-02-03
CVE-2026-25150 [CRITICAL] Prototype Pollution via FormData Processing in Qwik City
Prototype Pollution via FormData Processing in Qwik City
### Summary
A Prototype Pollution vulnerability exists in the `formToObj()` function within `@builder.io/qwik-city` middleware. The function processes form field names with dot notation (e.g., `user.name`) to create nested objects, but fails to sanitize dangerous property names like `__proto__`, `constructor`, and `prototype`. This allows unauthenticated attackers to pollute `Object.prototype` by sending crafted HTTP POST requests, potentially leading to privilege escalation, authentication bypass, or denial of service.
### Impact
An unauthenticated attacker can supply specially crafted form field names that cause formToObj() to write dangerous keys (for example __proto__, constructor, prototype) into parsed objects. This results
No detection rules found.
No public exploits indexed.
2026-02-03
Published