CVE-2026-25149

npm/@builder.io/qwik-city CVE-2026-25149: low

Qwik City Open Redirect via fixTrailingSlash

Action: Upgrade @builder.io/qwik-city to 1.19.0 or later.

npm i @builder.io/qwik-city@1.19.0

Affected

Fixed versions

Sources

• osv: GHSA-92j7-wgmg-f32m
• https://github.com/QwikDev/qwik/security/advisories/GHSA-92j7-wgmg-f32m
• https://nvd.nist.gov/vuln/detail/CVE-2026-25149
• https://github.com/QwikDev/qwik/commit/9959eab30a3ad9cc03689eaa080fcfbc33df71ed
• https://github.com/QwikDev/qwik

CVE-2026-25149 · published 2026-02-03T20:58:25Z · modified 2026-02-04T18:06:32.803006Z · JSON