CVE-2025-53620CWE-248

Crashing any Qwik Server

Critical · published July 9, 2025

CVSS v4.0
9.2
EPSS
0%
Percentile
28.1
In the wild
Unconfirmed
What it is

@builder.io/qwik-city is the meta-framework for Qwik. When a Qwik Server Action QRL is executed it dynamically load the file containing the symbol. When an invalid qfunc is sent, the server does not handle the thrown error. The error then causes Node JS to exit. This vulnerability is fixed in 1.13.0.

The record
Technical detail
CVSS v4.0
9.2 · CRITICAL
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H
EPSS
0.00356 · 28.1th percentile
Weakness
CWE-248 · Uncaught Exception
Published
2025-07-09T18:45Z
EPSS history
Timeline
  • 09 JUL 18:45Z
    Crashing any Qwik Server
    cvelistv5