Builder.Io Qwik-City vulnerabilities

CVE-2026-25150 [CRITICAL] CWE-1321 Prototype Pollution via FormData Processing in Qwik City Prototype Pollution via FormData Processing in Qwik City ### Summary A Prototype Pollution vulnerability exists in the `formToObj()` function within `@builder.io/qwik-city` middleware. The function processes form field names with dot notation (e.g., `user.name`) to create nested objects, but fails to sanitize dangerous property names like `__proto__`, `constructor`, and `prototype`. This allows unauthen

CVE-2025-53620 [CRITICAL] CWE-248 Qwik's unhandled exception vulnerabilty can cause server crashes from malicious requests Qwik's unhandled exception vulnerabilty can cause server crashes from malicious requests ### Summary Possibility to craft a request that will crash the Qwik Server in the default configuration. ### Details When a Qwik Server Action QRL is executed it dynamically load the file containing the symbol. When an invalid qfunc is sent, the server does not handle the thrown erro

CVE-2026-32701 [HIGH] CWE-843 Qwik City has array method pollution in FormData processing allows type confusion and DoS Qwik City has array method pollution in FormData processing allows type confusion and DoS **Summary** Qwik City improperly inferred arrays from dotted form field names during `FormData` parsing. By submitting mixed array-index and object-property keys for the same path, an attacker could cause user-controlled properties to be written onto values that application code expected

CVE-2026-25151 [MEDIUM] CWE-352 Qwik City has a CSRF Protection Bypass via Content-Type Header Validation Qwik City has a CSRF Protection Bypass via Content-Type Header Validation ### Summary Qwik City’s server-side request handler inconsistently interprets HTTP request headers, which can be abused by a remote attacker to circumvent form submission CSRF protections using specially crafted or multi-valued Content-Type headers. ### Impact A vulnerability in checkCSRF lets an attacker bypass Orig

CVE-2026-25155 [MEDIUM] CWE-352 Qwik City CSRF protection middleware does not work properly for content type header with parameters (eg. multipart/form-data) Qwik City CSRF protection middleware does not work properly for content type header with parameters (eg. multipart/form-data) ### Summary A typo in the regular expression within isContentType causes incorrect parsing of certain Content-Type headers. ### Impact An attacker can bypass Qwik City’s Origin-based CSRF protections and perform fo

CVE-2026-25149 [LOW] CWE-601 Qwik City Open Redirect via fixTrailingSlash Qwik City Open Redirect via fixTrailingSlash ### Summary **Description** An Open Redirect (CWE-601) vulnerability in Qwik City's default request handler middleware allows a remote attacker to redirect users to arbitrary protocol-relative URLs. Successful exploitation permits attackers to craft convincing phishing links that appear to originate from the trusted domain but redirect the victim to an attacker-controlled site

CVE-2026-25148 [MEDIUM] CWE-79 Qwik SSR XSS via Unsafe Virtual Node Serialization Qwik SSR XSS via Unsafe Virtual Node Serialization ### Summary **Description** A Cross-site Scripting (CWE-79) vulnerability in Qwik.js' server-side rendering virtual attribute serialization allows a remote attacker to inject arbitrary web scripts into server-rendered pages via virtual attributes. Successful exploitation permits script execution in a victim's browser in the context of the affected origin. This af

CVE-2023-2307 [MEDIUM] CWE-352 @builder.io/qwik-city Cross-Site Request Forgery vulnerability @builder.io/qwik-city Cross-Site Request Forgery vulnerability Cross-Site Request Forgery (CSRF) in GitHub repository builderio/qwik prior to 0.104.0.