CVE-2026-25150 is a critical prototype pollution flaw (CVSS 9.3) in Qwik, the JavaScript framework. The formToObj() function in the qwik-city middleware turns dotted form field names into nested objects without blocking dangerous names. Unauthenticated POST requests can pollute Object.prototype. Version 1.19.0 fixes it.
What's affected
- Affected: Qwik, specifically @builder.io/qwik-city, before 1.19.0.
- Fixed in: 1.19.0.
The advisory says the function accepts names such as user.name and builds nested objects, but does not sanitize the property names proto, constructor and prototype. The result can be privilege escalation, authentication bypass or denial of service, depending on how your application uses objects.
How to check if you're exposed
See which version of the package your app uses.
npm ls @builder.io/qwik-city
Check the lockfile too. If you build a Qwik City app that handles form posts on the server, the exposure applies to the server process. Static sites with no server side form handling are less likely to be reachable, though updating costs little.
What to do now
- Upgrade @builder.io/qwik-city to 1.19.0 or later, and rebuild and redeploy.
- After upgrading, restart server processes so no polluted state survives.
- Review code that reads properties from request derived objects without own property checks.
- Use objects without a prototype, or a Map, for data built from user input.
- Add a dependency scan to CI so the next framework fix reaches you quickly.
Why it matters
In JavaScript, setting a property on an object's prototype affects every object that inherits from it. If an attacker can write to that shared prototype, they can change defaults the rest of the code trusts, such as a flag that says a user is an administrator. The advisory lists this as a risk of privilege escalation, authentication bypass and denial of service.
The class is CWE-1321 (Improperly Controlled Modification of Object Prototype Attributes). The CVSS vector shows network access, no privileges, no user interaction and a changed scope. Because the pollution lives in the server process, one request can affect later requests from other users until the process restarts.
Try it yourself
Click through it at your own pace, or open it full screen. You can also paste a manifest into the free in-browser dependency scan, which runs in your browser, or look the CVE up in the Gold directory.
Quick check
Is CVE-2026-25150 exploited in the wild?
The record does not mark it as a CISA Known Exploited Vulnerability, and the advisory does not report exploitation.
Does this only affect apps with login?
No. The advisory describes unauthenticated attackers sending POST requests. Any server endpoint that parses form data this way is in scope.
Sources
Last reviewed: 19 October 2026.
