CVE-2026-25150

CVE-2026-25150 is a critical prototype pollution vulnerability affecting the @builder.io/qwik-city middleware in the Qwik JavaScript framework, specifically in versions prior to 1.19.0. Unauthenticated attackers can exploit the formToObj() function by sending crafted HTTP POST requests with malicious field names (e.g., __proto__) to inject properties into Object.prototype. This allows for severe impacts including privilege escalation, authentication bypass, or denial of service. The vulnerability has a CVSS score of 10.0 (Critical), indicating an easily exploitable network-based attack with low complexity and no user interaction required, leading to complete compromise of confidentiality, integrity, and availability. Despite its critical severity, there is currently no evidence of active exploitation, public exploit code (Metasploit, Nuclei, ExploitDB), or significant community discussion or media coverage. The EPSS score is very low, suggesting a low probability of exploitation in the wild.