Is CVE-2026-25149 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-25149 being exploited in the wild.

How severe is CVE-2026-25149?

Medium severity, with a CVSS score of 4, published 3 February 2026.

Which products and versions are affected?

Builder.Io Qwik-City before 1.19.0; @builder.io/qwik-city (npm) SEMVER:introduced=0,fixed=1.19.0.

Is there a fix for CVE-2026-25149?

Yes. @builder.io/qwik-city (npm): upgrade to 1.19.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-25149 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-25149?

Check whether you run Builder.Io Qwik-City or @builder.io/qwik-city (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-25149: Qwik City open redirect in fixTrailingSlash middleware

CVE-2026-25149 · Severity: medium · CVSS 4 · Published 2026-02-03

Qwik City is a full-stack web framework for building fast applications. A flaw in its URL normalization middleware allows attackers to craft malicious links that redirect users to attacker-controlled websites while appearing to come from the trusted domain. This enables phishing attacks and credential theft without requiring user authentication or special access.

Technologies: Builder.Io Qwik-City, @builder.io/qwik-city (npm). Vendors: Builder.Io, npm.

Quick answers

Is CVE-2026-25149 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-25149 being exploited in the wild.
How severe is CVE-2026-25149?: Medium severity, with a CVSS score of 4, published 3 February 2026.
Which products and versions are affected?: Builder.Io Qwik-City before 1.19.0; @builder.io/qwik-city (npm) SEMVER:introduced=0,fixed=1.19.0.
Is there a fix for CVE-2026-25149?: Yes. @builder.io/qwik-city (npm): upgrade to 1.19.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-25149 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-25149?: Check whether you run Builder.Io Qwik-City or @builder.io/qwik-city (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

@builder.io/qwik-city (npm): upgrade to 1.19.0 or later
```
npm install @builder.io/qwik-city@1.19.0
```

Technical details

An open redirect vulnerability (CWE-601) exists in Qwik City's fixTrailingSlash middleware, which automatically normalizes trailing slashes on page routes. The middleware fails to properly validate or sanitize protocol-relative URLs (starting with //), allowing attackers to inject arbitrary redirect targets. The vulnerability is triggered via a crafted URL that the middleware processes when handling 301 redirects; vulnerable runtimes like Bun that feature catch-all path matching and lack automatic URL normalization are most affected. Exploitation requires no authentication and is network-accessible. An attacker can craft a link that triggers a redirect to any attacker-controlled domain, enabling phishing and token theft. This vulnerability has been patched in qwik-city version 1.19.0.

Affected products

builder.io qwik-city before 1.19.0

Identifiers

CVE-2026-25149
GHSA-92j7-wgmg-f32m

Timeline

2026-02-03: disclosed
2026-02-03: patched: Fixed in version 1.19.0

References

https://github.com/QwikDev/qwik/security/advisories/GHSA-92j7-wgmg-f32m

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.