CVE-2025-53620 Crashing any Qwik Server

@builder.io/qwik-city is the meta-framework for Qwik. When a Qwik Server Action QRL is executed it dynamically load the file containing the symbol. When an invalid qfunc is sent, the server does not handle the thrown error. The error then causes Node JS to exit. This vulnerability is fixed in...

CVE-2025-53620 Crashing any Qwik Server

@builder.io/qwik-city is the meta-framework for Qwik. When a Qwik Server Action QRL is executed it dynamically load the file containing the symbol. When an invalid qfunc is sent, the server does not handle the thrown error. The error then causes Node JS to exit. This vulnerability is fixed in...

CVE-2025-53620 Crashing any Qwik Server

@builder.io/qwik-city is the meta-framework for Qwik. When a Qwik Server Action QRL is executed it dynamically load the file containing the symbol. When an invalid qfunc is sent, the server does not handle the thrown error. The error then causes Node JS to exit. This vulnerability is fixed in...

CVE-2025-53620

The CVE-2025-53620 issue affects @builder.io/qwik-city (Qwik meta-framework) where executing a Qwik Server Action QRL may load the file containing the symbol; if an invalid qfunc is sent, the server does not handle the thrown error, causing a Node.js process exit. This is documented as a vulnerab...

@react-portable/core (>=0.4.0, <=0.11.2), storybook-framework-qwik (>=0.3.0, <=0.4.0) potentially affected by CVE-2025-53620 via @builder.io/qwik-city (>=1.2.6, <=1.4.1)

@builder.io/qwik-city NPM version =1.2.6, =0.4.0, =0.3.0, =0.4.0 Source cves: CVE-2025-53620 Source advisory: OSV:GHSA-QR9H-J6XG-2J72...

GHSA-QR9H-J6XG-2J72 Qwik's unhandled exception vulnerabilty can cause server crashes from malicious requests

Summary Possibility to craft a request that will crash the Qwik Server in the default configuration. Details When a Qwik Server Action QRL is executed it dynamically load the file containing the symbol. When an invalid qfunc is sent, the server does not handle the thrown error. The error then...

Qwik's unhandled exception vulnerabilty can cause server crashes from malicious requests

Summary Possibility to craft a request that will crash the Qwik Server in the default configuration. Details When a Qwik Server Action QRL is executed it dynamically load the file containing the symbol. When an invalid qfunc is sent, the server does not handle the thrown error. The error then...

Qwik 安全漏洞

Qwik is a micro web framework open-sourced by Qwik Dev. A security vulnerability exists in Qwik versions prior to 1.13.0, which stems from an unhandled invalid qfunc error that could cause the service to crash...

PT-2025-28958 · Builder.Io · @Builder.Io/Qwik-City

Name of the Vulnerable Software and Affected Versions: @builder.io/qwik-city versions prior to 1.13.0 Description: The @builder.io/qwik-city meta-framework for Qwik is susceptible to an issue where improper handling of invalid qfunc during the execution of a Qwik Server Action QRL can lead to a...

CVE-2023-1283

Code Injection in GitHub repository builderio/qwik prior to 0.21.0...

CVE-2023-2307

Cross-Site Request Forgery CSRF in GitHub repository builderio/qwik prior to 0.104.0...

CVE-2023-0410

Cross-site Scripting XSS - Generic in GitHub repository builderio/qwik prior to 0.1.0-beta5...

@qwikui-org/ui (>=0.2.2, <=0.2.3), @react-portable/core (>=0.4.0, <=0.11.2) +1 more potentially affected by CVE-2024-41677 via @builder.io/qwik (>=1.2.6, <=1.4.5)

@builder.io/qwik NPM version =1.2.6, =0.2.2, =0.4.0, =0.11.2 - not-qwik-library-test1 0.0.3 Source cves: CVE-2024-41677 Source advisory: OSV:GHSA-2RWJ-7XQ8-4GX4...

GHSA-2RWJ-7XQ8-4GX4 Qwik has a potential mXSS vulnerability due to improper HTML escaping

Summary A potential mXSS vulnerability exists in Qwik for versions up to 1.6.0. Details Qwik improperly escapes HTML on server-side rendering. It converts strings according to the following rules: https://github.com/QwikDev/qwik/blob/v1.5.5/packages/qwik/src/core/render/ssr/render-ssr.tsL1182-L12...

Qwik has a potential mXSS vulnerability due to improper HTML escaping

Summary A potential mXSS vulnerability exists in Qwik for versions up to 1.6.0. Details Qwik improperly escapes HTML on server-side rendering. It converts strings according to the following rules: https://github.com/QwikDev/qwik/blob/v1.5.5/packages/qwik/src/core/render/ssr/render-ssr.tsL1182-L12...

CVE-2024-41677

Qwik is a performance focused javascript framework. A potential mutation XSS vulnerability exists in Qwik for versions up to but not including 1.6.0. Qwik improperly escapes HTML on server-side rendering. It converts strings according to the rules found in the render-ssr.ts file. It sometimes...

CVE-2024-41677 Cross-site Scripting (XSS) vulnerability due to improper HTML escaping in qwik

Qwik is a performance focused javascript framework. A potential mutation XSS vulnerability exists in Qwik for versions up to but not including 1.6.0. Qwik improperly escapes HTML on server-side rendering. It converts strings according to the rules found in the render-ssr.ts file. It sometimes...

CVE-2024-41677 Cross-site Scripting (XSS) vulnerability due to improper HTML escaping in qwik

Qwik is a performance focused javascript framework. A potential mutation XSS vulnerability exists in Qwik for versions up to but not including 1.6.0. Qwik improperly escapes HTML on server-side rendering. It converts strings according to the rules found in the render-ssr.ts file. It sometimes...

CVE-2024-41677

Summary: CVE-2024-41677 describes a mutation XSS (mXSS) vulnerability in Qwik due to improper HTML escaping during server-side rendering. The issue arises from how strings are escaped in render-ssr.ts, causing the final browser DOM to differ from the server render. Affected versions: up to, but n...

CVE-2024-41677 Cross-site Scripting (XSS) vulnerability due to improper HTML escaping in qwik

Qwik is a performance focused javascript framework. A potential mutation XSS vulnerability exists in Qwik for versions up to but not including 1.6.0. Qwik improperly escapes HTML on server-side rendering. It converts strings according to the rules found in the render-ssr.ts file. It sometimes...