2.7

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-25149

CVE-2026-25149: Qwik City Open Redirect via fixTrailingSlash

Qwik is a performance focused javascript framework. Prior to version 1.19.0, an Open Redirect vulnerability in Qwik City's default request handler middleware allows a remote attacker to redirect users to arbitrary protocol-relative URLs. Successful exploitation permits attackers to craft convincing phishing links that appear to originate from the trusted domain but redirect the victim to an attacker-controlled site. This issue has been patched in version 1.19.0.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-25149

CVE-2026-25149:

2.7

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
@builder.io/qwik-city	npm	< 1.19.0	1.19.0

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The analysis of the security patch (commit 9959eab30a3ad9cc03689eaa080fcfbc33df71ed) reveals an open redirect vulnerability (CWE-601) in the Qwik City framework. The root cause is the improper handling of protocol-relative URLs (e.g., //example.com) in two key locations.

First, the fixTrailingSlash middleware, which is applied by default to routes, did not validate if the request's pathname was a protocol-relative URL. When it processed a malicious path like //evil.com and determined a redirect was needed (e.g., to add a trailing slash), it would generate a Location header pointing to //evil.com/. Browsers interpret this as a redirect to an external domain, creating an open redirect vulnerability.

Second, the redirect method on the RequestEvent object also contained insufficient validation. Its regex for cleaning up URLs did not account for the leading // of a protocol-relative URL. This allowed for a direct, programmatic open redirect if an application passed an untrusted URL to this method.

The patch addresses both issues by adding explicit checks to detect and sanitize URLs that start with //, replacing them with a safe, absolute path (e.g., /evil.com). Therefore, both fixTrailingSlash and the redirect method are identified as the vulnerable functions that would appear in a runtime profile during exploitation.

Vulnerable functions

fixTrailingSlash

packages/qwik-city/src/middleware/request-handler/resolve-request-handlers.ts

This function is a middleware that automatically processes request URLs to enforce trailing slash consistency. Before the patch, it did not validate the pathname against protocol-relative URLs (e.g., '//evil.com'). When processing a malicious URL, the function would generate a redirect response with a 'Location' header pointing to the external URL, causing an open redirect.

RequestEvent.redirect

packages/qwik-city/src/middleware/request-handler/request-event.ts

This function, a method on the RequestEvent object, is used to programmatically issue redirects. The original implementation used a regular expression that failed to detect and sanitize protocol-relative URLs (e.g., '//evil.com'). An attacker could cause the application to call this method with a malicious URL, leading to an open redirect. The patch adds a specific check for URLs starting with '//' to fix this.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.