CVE-2026-25149: Qwik City Open Redirect Vulnerability in @builder.io/qwik-city
Summary
CVE-2026-25149: Qwik City Open Redirect via fixTrailingSlash. Affects @builder.io/qwik-city versions < 1.19.0. Fixed in 1.19.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Qwik City is a framework designed for building fast, optimized web applications. It provides a default request handler middleware that ensures URL consistency through features like the fixTrailingSlash middleware. However, this framework has a vulnerability that allows attackers to exploit its URL handling, potentially leading to serious security issues.
Vulnerability Detail
An Open Redirect (CWE-601) vulnerability exists in Qwik City's default request handler middleware. This flaw allows a remote attacker to redirect users to arbitrary protocol-relative URLs. The vulnerability arises from the middleware's handling of URL paths, particularly in environments that do not normalize these paths. Successful exploitation can lead to phishing attacks, where attackers craft links that appear to originate from a trusted domain but redirect victims to malicious sites. This issue affects all Qwik City applications deployed to runtimes with catch-all paths that match arbitrary domains.
How To Fix
Latest published version: 1.20.2 as of 22 Oct 2026
npm install @builder.io/qwik-city@1.20.2Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.19.0
This is the first release that contains the fix.
npm install @builder.io/qwik-city@1.19.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, developers can implement additional validation on the URLs being redirected to ensure they do not point to untrusted domains. This can be done by checking the URL against a whitelist of allowed domains before performing the redirect.
Conclusion
The Open Redirect vulnerability in Qwik City poses a significant risk to applications using this framework. It is crucial for developers to update to the patched version to mitigate potential exploitation. Utilizing tools like Vulert can help monitor for such vulnerabilities in real-time.
See every vulnerability recorded for @builder.io/qwik-city →
FAQ
An Open Redirect vulnerability allows attackers to redirect users to arbitrary URLs, potentially leading to phishing attacks and other malicious activities.
You can check if your application is affected by using Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Visit Vulert Scanner to analyze your package-lock.json without needing to sign up.
If left unaddressed, this vulnerability can be exploited for phishing attacks, leading to compromised user credentials and sensitive information theft.
Yes, the vulnerability has been patched in version 1.19.0 of the @builder.io/qwik-city package. Users are encouraged to update to this version.
The CVSS score for this vulnerability is 2.7, indicating a low severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for @builder.io/qwik-city.
