CVE-2026-25150: 
JavaScript vulnerability analysis and mitigation

CVE-2026-25150 is a prototype pollution vulnerability in the formToObj() function within the @builder.io/qwik-city middleware of the Qwik JavaScript framework. It affects all versions of the @builder.io/qwik-city npm package prior to 1.19.0, running on Node.js. The vulnerability was published on February 3, 2026, by researcher yueyueL via the GitHub Security Advisory GHSA-xqg6-98cw-gxhq, and patched in version 1.19.0 released the same day. It carries a CVSS v3.1 base score of 9.3 (Critical) per the GitHub Advisory, though Feedly also reports a score of 10.0 from an alternate scoring source (Github Advisory, Qwik Security Advisory).

The root cause is CWE-1321 (Improperly Controlled Modification of Object Prototype Attributes — 'Prototype Pollution'). The formToObj() function in packages/qwik-city/src/middleware/request-handler/request-event.ts processes HTML form field names using dot notation (e.g., user.name) to build nested JavaScript objects, but prior to the fix it used a plain {} as the root accumulator and did not filter dangerous key names such as __proto__, constructor, or prototype. An unauthenticated attacker can send a crafted HTTP POST request with form field names like __proto__.isAdmin=true or constructor.polluted=bad, causing formToObj() to write into Object.prototype and corrupt the shared prototype chain of the entire Node.js server process. The fix (commit 5f65bae) introduces an isDangerousKey() guard that skips any form entry containing these reserved keys at any path segment, and replaces the root object with Object.create(null) to eliminate prototype inheritance entirely (Qwik Security Advisory, Patch Commit).

Successful exploitation allows an unauthenticated remote attacker to pollute Object.prototype on the server, which affects all JavaScript objects in the running Node.js process. Depending on how the application uses objects, this can lead to privilege escalation (e.g., injecting isAdmin: true into all objects), authentication bypass, or denial of service by corrupting application logic globally. The CVSS scope is rated as 'Changed', reflecting that the impact extends beyond the vulnerable component to the broader application environment (Github Advisory, Qwik Security Advisory).

No public proof-of-concept exploit code has been confirmed, and there is no evidence of in-the-wild exploitation at this time (Github Advisory). The vulnerability requires no authentication, no user interaction, and is exploitable over the network with low attack complexity, making it trivially exploitable once a target is identified. The EPSS score is approximately 0.086% (25th percentile), indicating a currently low but non-negligible probability of exploitation within 30 days. The CVE is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog as of the time of this report. A Nuclei detection template pull request was submitted to the ProjectDiscovery repository, suggesting community interest in automated scanning (Github Advisory).

1. Reconnaissance: Identify web applications built with the Qwik framework (@builder.io/qwik-city) prior to version 1.19.0 by inspecting HTTP response headers, JavaScript bundle filenames, or package manifests exposed via misconfigured servers.
2. Identify form-handling endpoints: Locate any HTTP POST endpoint in the target Qwik application that processes HTML form submissions (i.e., endpoints using Content-Type: application/x-www-form-urlencoded or multipart/form-data), as these are routed through the vulnerable formToObj() middleware.
3. Craft malicious payload: Construct an HTTP POST request with form field names containing prototype pollution keys, for example:

   POST /target-endpoint HTTP/1.1
   Content-Type: application/x-www-form-urlencoded
   
   __proto__.isAdmin=true&__proto__.role=admin

   or using nested notation: user.__proto__.isAdmin=true.
4. Send the request: Submit the crafted request to the vulnerable endpoint. The formToObj() function will traverse the dot-separated key path and write isAdmin: true directly into Object.prototype.
5. Achieve objective: With Object.prototype polluted, all subsequently created plain objects in the server process will inherit the injected properties. Depending on application logic, this may bypass authentication checks (e.g., if (user.isAdmin)), escalate privileges, or cause denial of service through unexpected property collisions (Qwik Security Advisory, Patch Commit).

• Network: Unusual HTTP POST requests to Qwik application endpoints containing form field names with __proto__, constructor, or prototype as path segments (e.g., __proto__.isAdmin=true, constructor.polluted=bad) in the request body.
• Logs: Web server or application access logs showing POST requests with URL-encoded or multipart form bodies containing the strings __proto__, constructor, or prototype as field name prefixes or segments.
• Application Behavior: Unexpected privilege escalation events, authentication bypass incidents, or application crashes/errors that correlate with specific POST requests; objects unexpectedly inheriting properties they should not have (e.g., isAdmin, role, or other injected keys appearing on plain objects).
• Process: Anomalous Node.js process behavior such as unexpected crashes, unhandled exceptions related to object property access, or authorization logic returning unexpected results after processing specific form submissions (Qwik Security Advisory).

The primary remediation is to upgrade @builder.io/qwik-city to version 1.19.0 or later, which introduces the isDangerousKey() guard in formToObj() and uses Object.create(null) for the root parsed object, fully eliminating the prototype pollution vector (Qwik Security Advisory, Patch Commit). No official configuration-based workaround has been published; upgrading is the only supported fix. Organizations unable to upgrade immediately should consider deploying a Web Application Firewall (WAF) rule to block POST request bodies containing __proto__, constructor, or prototype as form field name segments as a temporary mitigation.

The vulnerability was reported by researcher yueyueL and published via GitHub Security Advisories on February 3, 2026, with the patch released the same day (Qwik Security Advisory). The CISA included the CVE in its weekly vulnerability bulletin (SB26-040) for the week of February 2, 2026, indicating it was flagged for broader awareness (CISA Bulletin). A Nuclei template pull request was submitted to ProjectDiscovery's nuclei-templates repository, reflecting community interest in automated detection of this vulnerability.