Skip to content
OpenAdvisories

Vendor

QwikDev

10 known vulnerabilities.

Products

qwik 10
All Critical High Medium Low Exploited only Public exploit

3 results · Clear filters · Feed

  • Critical 9.2
    CVE-2026-27971 Public exploit

    Qwik affected by unauthenticated RCE via server$ Deserialization

    Qwik is a performance focused javascript framework. qwik <=1.19.0 is vulnerable to RCE due to an unsafe deserialization vulnerability in the server$ RPC mechanism that allows any unauthenticated user to execute arbitrary code on the server with a single HTTP …

    QwikDev qwik @builder.io/qwik npm
  • Critical 9.3
    CVE-2026-25150

    Prototype Pollution via FormData Processing in Qwik City

    Qwik is a performance focused javascript framework. Prior to version 1.19.0, a prototype pollution vulnerability exists in the formToObj() function within @builder.io/qwik-city middleware. The function processes form field names with dot notation (e.g., user.…

    QwikDev qwik @builder.io/qwik-city npm
  • Critical 9.2
    CVE-2025-53620

    Crashing any Qwik Server

    @builder.io/qwik-city is the meta-framework for Qwik. When a Qwik Server Action QRL is executed it dynamically load the file containing the symbol. When an invalid qfunc is sent, the server does not handle the thrown error. The error then causes Node JS to ex…

    QwikDev qwik @builder.io/qwik-city npm