Qwik's unhandled exception vulnerabilty can cause server crashes from malicious requests

Description

Possibility to craft a request that will crash the Qwik Server in the default configuration.

Recommendation

Update the @builder.io/qwik-city package to the latest compatible version. Followings are version details:

• Affected version(s): < 1.13.0
• Patched version(s): 1.13.0

References

• GHSA-qr9h-j6xg-2j72
• CVE-2025-53620
• CWE-248
• CAPEC-310
• OWASP 2021-A6

Related Issues

• Opening a malicious website while running a Nuxt dev server could allow read-only access to code - CVE-2025-24361
• Opening a malicious website while running a Nuxt dev server could allow read-only access to code - @nuxt/webpack-builder - CVE-2025-24361
• Opening a malicious website while running a Nuxt dev server could allow read-only access to code - @nuxt/vite-builder - CVE-2025-24360
• string-math's string-math.js vulnerability can cause Regex Denial of Service (ReDoS) - CVE-2025-45143

You might also like:

Exploiting Server Version Disclosure

How to Secure your NodeJs Express Javascript Application - part 2

10 Secure Coding Best Practices to Follow in Every Project

Tags:

npm

@builder.io/qwik-city