Prototype Pollution Vulnerability in Qwik Framework by Builder.io

CVE-2026-25150

What is CVE-2026-25150?

The Qwik Framework, developed by Builder.io, has a vulnerability in the formToObj() function found in the @builder.io/qwik-city middleware. This issue arises when processing form field names using dot notation, which can result in the creation of nested objects. The flaw lies in its failure to properly sanitize certain risky property names, such as proto, constructor, and prototype. Attackers can exploit this vulnerability through specially crafted HTTP POST requests, leading to potential exploitation avenues including privilege escalation, authentication bypass, or denial of service. This vulnerability has been resolved in version 1.19.0.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References