Skip to content
OpenAdvisories

Package · npm

@builder.io/qwik-city

8 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

4 results · Clear filters · Feed

  • Medium 5.3
    CVE-2026-25148

    Qwik SSR XSS via Unsafe Virtual Node Serialization

    Qwik is a performance focused javascript framework. Prior to version 1.19.0, a Cross-Site Scripting vulnerability in Qwik.js' server-side rendering virtual attribute serialization allows a remote attacker to inject arbitrary web scripts into server-rendered p…

    QwikDev qwik @builder.io/qwik-city npm
  • Medium 5.9
    CVE-2026-25151

    Qwik City has a CSRF Protection Bypass via Content-Type Header Validation

    Qwik is a performance focused javascript framework. Prior to version 1.19.0, Qwik City’s server-side request handler inconsistently interprets HTTP request headers, which can be abused by a remote attacker to circumvent form submission CSRF protections using …

    QwikDev qwik @builder.io/qwik-city npm
  • Medium 5.9
    CVE-2026-25155

    [qwik-city] CSRF protection middleware does not work properly for content type header with parameters (eg. multipart/form-data)

    Qwik is a performance focused javascript framework. Prior to version 1.12.0, a typo in the regular expression within isContentType causes incorrect parsing of certain Content-Type headers. This issue has been patched in version 1.12.0.

    QwikDev qwik @builder.io/qwik-city npm
  • Medium 4.7
    CVE-2023-2307

    Cross-Site Request Forgery (CSRF) in builderio/qwik

    Cross-Site Request Forgery (CSRF) in GitHub repository builderio/qwik prior to 0.104.0.

    BuilderIO builderio/qwik @builder.io/qwik-city npm