CVE-2026-25149: Qwik City Open Redirect via fixTrailingSlash

February 3, 2026 (updated February 4, 2026)

Description An Open Redirect (CWE-601) vulnerability in Qwik City’s default request handler middleware allows a remote attacker to redirect users to arbitrary protocol-relative URLs. Successful exploitation permits attackers to craft convincing phishing links that appear to originate from the trusted domain but redirect the victim to an attacker-controlled site. This affects qwik-city before version 1.19.0. This has been patched in qwik-city version 1.19.0.

References

github.com/QwikDev/qwik
github.com/QwikDev/qwik/commit/9959eab30a3ad9cc03689eaa080fcfbc33df71ed
github.com/QwikDev/qwik/security/advisories/GHSA-92j7-wgmg-f32m
github.com/advisories/GHSA-92j7-wgmg-f32m
nvd.nist.gov/vuln/detail/CVE-2026-25149

Code Behaviors & Features

Detect and mitigate CVE-2026-25149 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →