Description
A Prototype Pollution vulnerability exists in the formToObj() function within @builder.io/qwik-city middleware. The function processes form field names with dot notation (e.g., user.name) to create nested objects, but fails to sanitize dangerous property names like __proto__, constructor, and prototype.
Recommendation
Update the @builder.io/qwik-city package to the latest compatible version. Followings are version details:
- Affected version(s): < 1.19.0
- Patched version(s): 1.19.0
References
Could your website be exposed too?
SmartScanner can check your website for Prototype Pollution via FormData Processing in Qwik City and gives you actionable findings to investigate.
Start a free scanRelated Issues
- Qwik City has array method pollution in FormData processing allows type confusion and DoS - CVE-2026-32701
- Qwik City has a CSRF Protection Bypass via Content-Type Header Validation - CVE-2026-25151
- Qwik City Open Redirect via fixTrailingSlash - CVE-2026-25149
- @phun-ky/defaults-deep Has a Prototype Pollution issue via Unsafe Recursive Property Merging - CVE-2026-54737
You might also like:
See something that needs correcting? Let us knowUpdated February 04, 2026