What is the CVSS score of CVE-2026-25150?

CVE-2026-25150 has a CVSS 3.1 base score of 9.3 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:L. EPSS exploitation probability: 0.1%.

Which versions of Qwik are affected by CVE-2026-25150?

A critical prototype pollution vulnerability in Qwik framework versions prior to 1.19.0 allows unauthenticated attackers to manipulate application behavior through crafted web requests, potentially…. A patch is available.

How to fix or mitigate CVE-2026-25150?

Within 24 hours: Identify all applications and services using Qwik framework versions prior to 1.19.0 through dependency scanning and asset inventory. Within 7 days: Deploy version 1.19.0 or later to development and staging environments, conduct regression testing, and establish a phased production rollout plan. Within 30 days: Complete production deployment across all affected systems and validate patch effectiveness through security testing.

Qwik CVE-2026-25150

CRITICAL

Improperly Controlled Modification of Object Prototype Attributes (Prototype Pollution) (CWE-1321)

2026-02-03 security-advisories@github.com

GHSA-xqg6-98cw-gxhq

Denial Of Service Privilege Escalation Authentication Bypass Qwik

9.3

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

9.3 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:L

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

None

Integrity

High

Availability

Low

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 21:54 vuln.today

Patch released

Feb 10, 2026 - 20:10 nvd

Patch available

CVE Published

Feb 03, 2026 - 22:16 nvd

CRITICAL 9.3

DescriptionGitHub Advisory

Qwik is a performance focused javascript framework. Prior to version 1.19.0, a prototype pollution vulnerability exists in the formToObj() function within @builder.io/qwik-city middleware. The function processes form field names with dot notation (e.g., user.name) to create nested objects, but fails to sanitize dangerous property names like __proto__, constructor, and prototype. This allows unauthenticated attackers to pollute Object.prototype by sending crafted HTTP POST requests, potentially leading to privilege escalation, authentication bypass, or denial of service. This issue has been patched in version 1.19.0.

AnalysisAI

Qwik JavaScript framework prior to 1.19.0 has a prototype pollution vulnerability that can lead to server-side code execution in SSR applications.

Technical ContextAI

Qwik < 1.19.0 has a CWE-1321 prototype pollution vulnerability that allows attackers to inject properties into JavaScript prototypes, which in SSR (Server-Side Rendering) contexts can escalate to code execution.