Qwik vulnerabilities

Products

• Qwik 11

Newest

• qwik Qwik has array method pollution in FormData processing, allowing type confusion and DoS CVE-2026-32701 Fix available 7.5 HighMarch 20, 2026
• qwik Qwik affected by unauthenticated RCE via server$ Deserialization CVE-2026-27971 Public exploitFix available 9.2 CriticalMarch 2, 2026
• qwik [qwik-city] CSRF protection middleware does not work properly for content type header with parameters (eg. multipart/form-data) CVE-2026-25155 Fix available 5.9 MediumFebruary 3, 2026
• qwik Qwik City Open Redirect via fixTrailingSlash CVE-2026-25149 Fix available 2.7 LowFebruary 3, 2026
• qwik Qwik City has a CSRF Protection Bypass via Content-Type Header Validation CVE-2026-25151 Fix available 5.9 MediumFebruary 3, 2026
• qwik Prototype Pollution via FormData Processing in Qwik City CVE-2026-25150 Fix available 9.3 CriticalFebruary 3, 2026
• qwik Qwik SSR XSS via Unsafe Virtual Node Serialization CVE-2026-25148 Fix available 5.3 MediumFebruary 3, 2026
• qwik Cross-site Scripting (XSS) vulnerability due to improper HTML escaping in qwik CVE-2024-41677 Fix available 6.3 MediumAugust 6, 2024
• builderio builderio/qwik, qwik +1 more Cross-Site Request Forgery (CSRF) in builderio/qwik CVE-2023-2307 Fix available 4.7 MediumApril 26, 2023
• builderio builderio/qwik, qwik +1 more Code Injection in builderio/qwik CVE-2023-1283 Fix available 10.0 CriticalMarch 8, 2023
• builderio builderio/qwik, qwik +1 more Cross-site Scripting (XSS) - Generic in builderio/qwik CVE-2023-0410 Fix available 6.1 MediumJanuary 20, 2023