Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
8 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
Qwik City improperly inferred arrays from dotted form field names during FormData parsing. By submitting mixed array-index and object-property keys for the same path, an attacker could cause user-controlled properties to be written onto values that application code expected to be arrays. Description When processing application/x-www-form-urlencoded or multipart/form-data requests, Qwik City converted dotted field names such as items.0 and items.1 into nested structures. If a path was interpreted as an array, additional attacker-controlled keys on the same path, such as items.toString, items.push, items.valueOf, or items.length, could alter the resulting server-side value in unexpected ways. Applications that assumed these parsed values were safe arrays could be affected. Depending on application behavior, this could lead to request handling failures, denial of service through malformed array state or oversized lengths, and type confusion in downstream code. This issue affects…
Recommended action: Upgrade to 1.19.2 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
A typo in the regular expression within isContentType causes incorrect parsing of certain Content-Type headers. Impact An attacker can bypass Qwik City’s Origin-based CSRF protections and perform forged form submissions, potentially causing unauthorized state changes.
Recommended action: Upgrade to 1.12.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Description An Open Redirect (CWE-601) vulnerability in Qwik City's default request handler middleware allows a remote attacker to redirect users to arbitrary protocol-relative URLs. Successful exploitation permits attackers to craft convincing phishing links that appear to originate from the trusted domain but redirect the victim to an attacker-controlled site. This affects qwik-city before version 1.19.0. This has been patched in qwik-city version 1.19.0. Impact Qwik City automatically applies the fixTrailingSlash middleware to page routes to ensure URL consistency. This vulnerability impacts all Qwik City applications deployed to runtimes that have a catch-all path to match arbitrary domains and that do not automatically normalize URL paths (e.g. Bun). Exploitation allows an attacker to craft links that trigger a 301 redirect to arbitrary protocol-relative URLs. Browsers interpret this Location header as a protocol-relative URL, redirecting the user to attacker-controlled…
Recommended action: Upgrade to 1.19.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Qwik City’s server-side request handler inconsistently interprets HTTP request headers, which can be abused by a remote attacker to circumvent form submission CSRF protections using specially crafted or multi-valued Content-Type headers. Impact A vulnerability in checkCSRF lets an attacker bypass Origin-based CSRF checks by using malformed or multi-valued Content-Type headers. Exploitation requires the CORS preflight to succeed (so it’s blocked if preflight is denied) and is possible when the application accepts cross-origin requests or via non-browser clients. Impact varies with server CORS and cookie policies and may enable unauthorized state changes.
Recommended action: Upgrade to 1.19.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
A Prototype Pollution vulnerability exists in the formToObj() function within @builder.io/qwik-city middleware. The function processes form field names with dot notation (e.g., user.name) to create nested objects, but fails to sanitize dangerous property names like proto, constructor, and prototype. This allows unauthenticated attackers to pollute Object.prototype by sending crafted HTTP POST requests, potentially leading to privilege escalation, authentication bypass, or denial of service. Impact An unauthenticated attacker can supply specially crafted form field names that cause formToObj() to write dangerous keys (for example proto, constructor, prototype) into parsed objects. This results in Prototype Pollution of the server process and can cause privilege escalation, auth bypass, denial-of-service, or other global application integrity failures depending on how objects are used.
Recommended action: Upgrade to 1.19.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Description A Cross-site Scripting (CWE-79) vulnerability in Qwik.js' server-side rendering virtual attribute serialization allows a remote attacker to inject arbitrary web scripts into server-rendered pages via virtual attributes. Successful exploitation permits script execution in a victim's browser in the context of the affected origin. This affects qwik-city before version 1.19.0. This has been patched in qwik-city version 1.19.0. Impact This vulnerability impacts applications that dynamically populate Virtual Node attributes with keys/values that users can influence. Applications that hard-code these keys/values are unaffected. Qwik doesn't use traditional hydration. Instead, it serializes application state into the HTML so the client can resume execution from the server-rendered output. To support this, Qwik v1 marks component boundaries with HTML comments. SSR builds comment content for Virtual components by concatenating structural attribute names and values without…
Recommended action: Upgrade to 1.19.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Possibility to craft a request that will crash the Qwik Server in the default configuration. Details When a Qwik Server Action QRL is executed it dynamically load the file containing the symbol. When an invalid qfunc is sent, the server does not handle the thrown error. The error then causes Node JS to exit. PoC 1. Setup a Qwik Project pnpm create qwik@latest 2. Start the Qwik Server using pnpm run preview 3. Execute the following curl command to crash the instance Here the qfunc query parameter, X-Qrl header and payload need to have the same qrl. The Qwik Server will then crash with the message The same can also be repeated running Qwik in production using express. 1. Setup a Qwik Project pnpm create qwik@latest 2. Install the express middleware pnpm run qwik add express 3. Build the qwik app using pnpm run build 4. Start the server using pnpm run serve 5. Execute the following curl command to crash the instance Impact Any Qwik Server instance running the default…
Recommended action: Upgrade to 1.13.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Cross-Site Request Forgery (CSRF) in GitHub repository builderio/qwik prior to 0.104.0.
Recommended action: Upgrade to 0.104.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.