p PatchFirst

PatchFirst · Aktuelle Sicherheitslücken

Sicherheitslücken in @builder.io/qwik-city

In den letzten 30 Tagen veröffentlichte Sicherheitslücken für @builder.io/qwik-city: 0. Davon im KEV-Katalog: 0.

RSS ↗ JSON ↗
Sicherheitslücken filtern
Filter zurücksetzen

Sicherheitslücken: 8

  1. CVE-2026-32701

    Hoch · CVSS 7.5EPSS 0,44%Korrektur verfügbar

    Qwik has array method pollution in FormData processing, allowing type confusion and DoS

    Qwik is a performance-focused JavaScript framework. Versions prior to 1.19.2 improperly inferred arrays from dotted form field names during FormData parsing. By submitting mixed array-index and object-property keys for the same path, an attacker could cause user-controlled properties to be written onto values that application code expected to be arrays. When processing application/x-www-form-urlencoded or multipart/form-data requests, Qwik City converted dotted field names (e.g., items.0, items.1) into nested structures. If a path was interpreted as an array, additional attacker-supplied keys on that path—such as items.toString, items.push, i

    @builder.io/qwik-cityNode.js
    • Auf 1.19.2 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  2. CVE-2026-25150

    Kritisch · CVSS 9.3EPSS 0,72%Korrektur verfügbar

    Prototype Pollution via FormData Processing in Qwik City

    Qwik is a performance focused javascript framework. Prior to version 1.19.0, a prototype pollution vulnerability exists in the formToObj() function within @builder.io/qwik-city middleware. The function processes form field names with dot notation (e.g., user.name) to create nested objects, but fails to sanitize dangerous property names like __proto__, constructor, and prototype. This allows unauthenticated attackers to pollute Object.prototype by sending crafted HTTP POST requests, potentially leading to privilege escalation, authentication bypass, or denial of service. This issue has been patched in version 1.19.0.

    @builder.io/qwik-cityNode.js
    • Auf 1.19.0 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  3. CVE-2026-25148

    Mittel · CVSS 5.3EPSS 0,35%Korrektur verfügbar

    Qwik SSR XSS via Unsafe Virtual Node Serialization

    Qwik is a performance focused javascript framework. Prior to version 1.19.0, a Cross-Site Scripting vulnerability in Qwik.js' server-side rendering virtual attribute serialization allows a remote attacker to inject arbitrary web scripts into server-rendered pages via virtual attributes. Successful exploitation permits script execution in a victim's browser in the context of the affected origin. This issue has been patched in version 1.19.0.

    @builder.io/qwik-cityNode.js
    • Auf 1.19.0 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  4. CVE-2026-25151

    Mittel · CVSS 5.9EPSS 0,18%Korrektur verfügbar

    Qwik City has a CSRF Protection Bypass via Content-Type Header Validation

    Qwik is a performance focused javascript framework. Prior to version 1.19.0, Qwik City’s server-side request handler inconsistently interprets HTTP request headers, which can be abused by a remote attacker to circumvent form submission CSRF protections using specially crafted or multi-valued Content-Type headers. This issue has been patched in version 1.19.0.

    @builder.io/qwik-cityNode.js
    • Auf 1.19.0 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  5. CVE-2026-25155

    Mittel · CVSS 5.9EPSS 0,15%Korrektur verfügbar

    [qwik-city] CSRF protection middleware does not work properly for content type header with parameters (eg. multipart/form-data)

    Qwik is a performance focused javascript framework. Prior to version 1.12.0, a typo in the regular expression within isContentType causes incorrect parsing of certain Content-Type headers. This issue has been patched in version 1.12.0.

    @builder.io/qwik-cityNode.js
    • Auf 1.12.0 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  6. CVE-2026-25149

    Niedrig · CVSS 2.7EPSS 0,27%Korrektur verfügbar

    Qwik City Open Redirect via fixTrailingSlash

    Qwik is a performance focused javascript framework. Prior to version 1.19.0, an Open Redirect vulnerability in Qwik City's default request handler middleware allows a remote attacker to redirect users to arbitrary protocol-relative URLs. Successful exploitation permits attackers to craft convincing phishing links that appear to originate from the trusted domain but redirect the victim to an attacker-controlled site. This issue has been patched in version 1.19.0.

    @builder.io/qwik-cityNode.js
    • Auf 1.19.0 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  7. CVE-2025-53620

    Kritisch · CVSS 9.2EPSS 0,36%Korrektur verfügbar

    Crashing any Qwik Server

    @builder.io/qwik-city is the meta-framework for Qwik. When a Qwik Server Action QRL is executed it dynamically load the file containing the symbol. When an invalid qfunc is sent, the server does not handle the thrown error. The error then causes Node JS to exit. This vulnerability is fixed in 1.13.0.

    @builder.io/qwik-cityNode.js
    • Auf 1.13.0 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗

Prüfen Sie Ihren Server

Gleichen Sie Ihren installierten Stack und seine Versionen mit den aktuellen Sicherheitsmeldungen ab.

Prüfen Sie Ihren Server →