CVE-2026-25149: 
JavaScript vulnerability analysis and mitigation

CVE-2026-25149 is an Open Redirect vulnerability (CWE-601) in Qwik City's fixTrailingSlash middleware that allows remote attackers to redirect users to arbitrary protocol-relative URLs. It affects the @builder.io/qwik-city npm package in all versions prior to 1.19.0. The vulnerability was published on February 3, 2026, and patched in version 1.19.0. It carries a CVSS v3.1 score of 6.1 (Medium) and a CVSS v4.0 score of 2.7 (Low) (Github Advisory, Qwik Security Advisory).

The root cause lies in the fixTrailingSlash middleware within Qwik City's default request handler (resolve-request-handlers.ts). When a Qwik City application is deployed on a runtime with a catch-all path (e.g., Bun) that does not automatically normalize URL paths, the middleware fails to validate pathnames beginning with // (protocol-relative URLs). An attacker can craft a request to a URL such as http://victim.com//attacker.com, which the middleware processes and issues a 301 redirect with a Location: //attacker.com header. Browsers interpret //attacker.com as a protocol-relative URL and redirect the user to the attacker's domain. The fix, applied in commit 9959eab, adds an explicit check to reject or sanitize pathnames starting with // before any redirect is issued (Qwik Security Advisory, Patch Commit).

Successful exploitation enables attackers to craft phishing links that appear to originate from a trusted Qwik City domain but silently redirect victims to attacker-controlled sites. This can facilitate credential theft, session token capture, and other social engineering attacks. There is no direct impact on the confidentiality or integrity of the vulnerable server itself; the primary risk is to end users who follow maliciously crafted links (Github Advisory).

No public proof-of-concept exploit code has been reported, and there is no evidence of active in-the-wild exploitation at this time. The vulnerability requires user interaction — a victim must click a crafted link — but requires no authentication or special privileges from the attacker. The EPSS score is approximately 0.044% (0.019% per GitHub Advisory), indicating a low probability of near-term exploitation. The CVE is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (Github Advisory).

1. Reconnaissance: Identify publicly accessible Qwik City applications running on runtimes that do not normalize URL paths (e.g., Bun), using version information from package manifests or HTTP response headers to confirm versions prior to 1.19.0.
2. Craft malicious URL: Construct a URL targeting the vulnerable application with a double-slash path, such as https://trusted-qwik-app.com//attacker.com or https://trusted-qwik-app.com////attacker.com.
3. Trigger redirect: Send or share the crafted URL. The fixTrailingSlash middleware processes the request and issues a 301 Moved Permanently response with Location: //attacker.com (or //attacker.com/path).
4. Browser interprets protocol-relative URL: The victim's browser receives the Location: //attacker.com header and redirects to https://attacker.com (inheriting the current protocol), landing the user on the attacker-controlled site.
5. Phishing/token theft: The attacker presents a convincing clone of the legitimate application to harvest credentials, session tokens, or other sensitive information from the redirected user (Qwik Security Advisory, Patch Commit).

• Network: HTTP requests to Qwik City application URLs containing double-slash path segments (e.g., GET //attacker.com HTTP/1.1 or GET ////attacker.com HTTP/1.1); 301 responses with Location headers beginning with // (protocol-relative URLs).
• Logs: Web server or application access logs showing requests with paths starting with // or multiple leading slashes; console warning messages matching the pattern Redirect URL //[...] is invalid, fixing to /[...] (present only in patched versions).
• User Reports: Users reporting unexpected redirects to external domains after clicking links that appeared to belong to the legitimate application domain.

Upgrade @builder.io/qwik-city to version 1.19.0 or later, which includes a fix that explicitly rejects or sanitizes pathnames starting with // before processing redirects (Qwik Security Advisory, Patch Commit). As a temporary workaround for environments where immediate patching is not possible, configure the runtime or a reverse proxy (e.g., Nginx, Cloudflare) to normalize URL paths and reject requests with double-slash prefixes before they reach the Qwik City application. Additionally, apply input validation at the edge to block or rewrite URLs matching the pattern ^//.