A remote attacker can redirect users to arbitrary protocol‑relative URLs by exploiting an open redirect flaw in the default request handler middleware of Qwik City, a performance‑focused JavaScript framework. Prior to version 1.19.0 this vulnerability allows attackers to craft convincing phishing links that appear to originate from a trusted domain yet lead victims to attacker‑controlled sites. The weakness, identified as CWE‑601, originates from the middleware’s handling of trailing‑slash logic without validating the redirect target.

Affected systems include QwikDev’s Qwik framework deployed in any environment before version 1.19.0, running on supported runtimes such as Node.js. Users who have not upgraded to or beyond the patched release are potentially exposed through the framework’s default request handler.

The CVSS score of 2.7 classifies the issue as low severity, and the EPSS score of < 1 % indicates a very low likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that an attacker would need to embed a crafted URL in content served by the vulnerable application; the request handler processes the trailing‑slash logic without validating the target, thereby enabling the redirect.