# CVE-2026-25149: Qwik City open redirect in fixTrailingSlash middleware

Source: https://junglewise.ai/threats/cve-2026-25149-qwik-city-open-redirect-in-fixtrailingslash-middleware  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-02-03. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-25149 · Severity: medium · CVSS 4 · Published 2026-02-03

Qwik City is a full-stack web framework for building fast applications. A flaw in its URL normalization middleware allows attackers to craft malicious links that redirect users to attacker-controlled websites while appearing to come from the trusted domain. This enables phishing attacks and credential theft without requiring user authentication or special access.

Technologies: [Builder.Io Qwik-City](https://junglewise.ai/threats/technologies/qwik-city), [@builder.io/qwik-city (npm)](https://junglewise.ai/threats/technologies/builder-io-qwik-city). Vendors: [Builder.Io](https://junglewise.ai/threats/vendors/builder-io), [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2026-25149 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-25149 being exploited in the wild.

**How severe is CVE-2026-25149?** Medium severity, with a CVSS score of 4, published 3 February 2026.

**Which products and versions are affected?** Builder.Io Qwik-City before 1.19.0; @builder.io/qwik-city (npm) SEMVER:introduced=0,fixed=1.19.0.

**Is there a fix for CVE-2026-25149?** Yes. @builder.io/qwik-city (npm): upgrade to 1.19.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-25149 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-25149?** Check whether you run Builder.Io Qwik-City or @builder.io/qwik-city (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- @builder.io/qwik-city (npm): upgrade to 1.19.0 or later

  ```sh
  npm install @builder.io/qwik-city@1.19.0
  ```


## Technical details

An open redirect vulnerability (CWE-601) exists in Qwik City's fixTrailingSlash middleware, which automatically normalizes trailing slashes on page routes. The middleware fails to properly validate or sanitize protocol-relative URLs (starting with //), allowing attackers to inject arbitrary redirect targets. The vulnerability is triggered via a crafted URL that the middleware processes when handling 301 redirects; vulnerable runtimes like Bun that feature catch-all path matching and lack automatic URL normalization are most affected. Exploitation requires no authentication and is network-accessible. An attacker can craft a link that triggers a redirect to any attacker-controlled domain, enabling phishing and token theft. This vulnerability has been patched in qwik-city version 1.19.0.

## Affected products

- builder.io qwik-city before 1.19.0

## Identifiers

- CVE-2026-25149
- GHSA-92j7-wgmg-f32m

## Timeline

- 2026-02-03: disclosed
- 2026-02-03: patched: Fixed in version 1.19.0

## References

- [https://github.com/QwikDev/qwik/security/advisories/GHSA-92j7-wgmg-f32m](https://github.com/QwikDev/qwik/security/advisories/GHSA-92j7-wgmg-f32m)

## Related threats

- [Builder.io Qwik City array method pollution in FormData parsing](https://junglewise.ai/threats/cve-2026-32701-builder-io-qwik-city-array-method-pollution-in-formdata-parsing)
- [Qwik City CSRF protection middleware regex parsing bypass](https://junglewise.ai/threats/cve-2026-25155-qwik-city-csrf-protection-middleware-regex-parsing-bypass)
- [Qwik City CSRF bypass via Content-Type header validation](https://junglewise.ai/threats/cve-2026-25151-qwik-city-csrf-bypass-via-content-type-header-validation)
- [Builder.io Qwik City prototype pollution in form processing](https://junglewise.ai/threats/cve-2026-25150-builder-io-qwik-city-prototype-pollution-in-form-processing)
- [Qwik SSR XSS via unsafe virtual node serialization](https://junglewise.ai/threats/cve-2026-25148-qwik-ssr-xss-via-unsafe-virtual-node-serialization)