{"action":"Upgrade @builder.io/qwik-city to 1.19.0 or later.","affected":[{"fixed":"1.19.0","introduced":"0"}],"component":"@builder.io/qwik-city","cve_ids":["CVE-2026-25149"],"ecosystem":"npm","epss":0.00274,"exploited":false,"fixed_versions":["1.19.0"],"ghsa_id":"GHSA-92j7-wgmg-f32m","id":"tcs_01M5KFEF0EB7SPZBVWWK9Z7EH9","modified_at":"2026-02-04T18:06:32.803006Z","published_at":"2026-02-03T20:58:25Z","references":["https://osv.dev/vulnerability/GHSA-92j7-wgmg-f32m","https://github.com/QwikDev/qwik/security/advisories/GHSA-92j7-wgmg-f32m","https://nvd.nist.gov/vuln/detail/CVE-2026-25149","https://github.com/QwikDev/qwik/commit/9959eab30a3ad9cc03689eaa080fcfbc33df71ed","https://github.com/QwikDev/qwik"],"severity":{"label":"low"},"sources":[{"source":"osv","source_id":"GHSA-92j7-wgmg-f32m","url":"https://osv.dev/vulnerability/GHSA-92j7-wgmg-f32m"}],"summary":"Qwik City Open Redirect via fixTrailingSlash"}