CVE-2025-53620criticalCWE-248

CVE-2025-53620: falha crítica em QwikDev qwik

Crashing any Qwik Server

Publicada em

Seguir esta CVE+ Monitorar qwik+ Monitorar @builder.io/qwik-city

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

28Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 9.2epss 0.4%
@builder.io/qwik-city is the meta-framework for Qwik. When a Qwik Server Action QRL is executed it dynamically load the file containing the symbol. When an invalid qfunc is sent, the server does not handle the thrown error. The error then causes Node JS to exit. This vulnerability is fixed in 1.13.0.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H
Produtos afetados
QwikDev · qwik
CVEs relacionadas — QwikDev qwik

No mesmo produto, das mais perigosas para as menos.

CVE-2026-27971CRITICALQwik affected by unauthenticated RCE via server$ DeserializationEPSS 5.5%CVE-2026-25150CRITICALPrototype Pollution via FormData Processing in Qwik CityEPSS 0.7%CVE-2026-84994HIGHQwik: Crashing any Qwik Server via Resource thenableEPSS 0.5%CVE-2024-41677MEDIUMCross-site Scripting (XSS) vulnerability due to improper HTML escaping in qwikEPSS 0.5%CVE-2026-32701HIGHQwik has array method pollution in FormData processing, allowing type confusion and DoSEPSS 0.5%CVE-2026-25148MEDIUMQwik SSR XSS via Unsafe Virtual Node SerializationEPSS 0.3%