Prototype Pollution via FormData Processing in Qwik City

Description

A Prototype Pollution vulnerability exists in the formToObj() function within @builder.io/qwik-city middleware. The function processes form field names with dot notation (e.g., user.name) to create nested objects, but fails to sanitize dangerous property names like __proto__, constructor, and prototype.

Recommendation

Update the @builder.io/qwik-city package to the latest compatible version. Followings are version details:

• Affected version(s): < 1.19.0
• Patched version(s): 1.19.0

References

• GHSA-xqg6-98cw-gxhq
• CVE-2026-25150
• CWE-1321
• CAPEC-310
• OWASP 2021-A6

Related Issues

• Qwik City has array method pollution in FormData processing allows type confusion and DoS - CVE-2026-32701
• Qwik City has a CSRF Protection Bypass via Content-Type Header Validation - CVE-2026-25151
• Qwik City Open Redirect via fixTrailingSlash - CVE-2026-25149
• @phun-ky/defaults-deep Has a Prototype Pollution issue via Unsafe Recursive Property Merging - CVE-2026-54737

You might also like:

How to Secure your NodeJs Express Javascript Application - part 1

How to Secure your NodeJs Express Javascript Application - part 2

10 Secure Coding Best Practices to Follow in Every Project

Tags:

npm

@builder.io/qwik-city