Critical severity · published Jul 9, 2025
CVE-2025-53620
Crashing any Qwik Server
9.2
CVSS
0.4%
EPSS
No
On KEV
Description
@builder.io/qwik-city is the meta-framework for Qwik. When a Qwik Server Action QRL is executed it dynamically load the file containing the symbol. When an invalid qfunc is sent, the server does not handle the thrown error. The error then causes Node JS to exit. This vulnerability is fixed in 1.13.0.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 29% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
QW
qwik · QwikDev
< 1.13.0 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-53620
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-53620
github.com
https://github.com/QwikDev/qwik/security/advisories/GHSA-qr9h-j6xg-2j72
More from qwik
10.0
CVE-2026-25150
Prototype Pollution via FormData Processing in Qwik City
9.8
CVE-2026-27971
Qwik affected by unauthenticated RCE via server$ Deserialization
8.7
CVE-2026-84994
Qwik: Crashing any Qwik Server via Resource thenable
7.5
CVE-2026-32701
Qwik has array method pollution in FormData processing, allowing type confusion and DoS
7.1
CVE-2026-25155
[qwik-city] CSRF protection middleware does not work properly for content type header with parameters (eg. multipart/form-data)