Qwikdev Qwik vulnerabilities

• @builder.io qwik Qwik: Crashing any Qwik Server via Resource thenable CVE-2026-84994 Fix available 8.7 HighOctober 13, 2026
• qwik Qwik has array method pollution in FormData processing, allowing type confusion and DoS CVE-2026-32701 Fix available 7.5 HighMarch 20, 2026
• qwik Qwik affected by unauthenticated RCE via server$ Deserialization CVE-2026-27971 Public exploitFix available 9.2 CriticalMarch 2, 2026
• qwik [qwik-city] CSRF protection middleware does not work properly for content type header with parameters (eg. multipart/form-data) CVE-2026-25155 Fix available 5.9 MediumFebruary 3, 2026
• qwik Qwik City Open Redirect via fixTrailingSlash CVE-2026-25149 Fix available 2.7 LowFebruary 3, 2026
• qwik Qwik City has a CSRF Protection Bypass via Content-Type Header Validation CVE-2026-25151 Fix available 5.9 MediumFebruary 3, 2026
• qwik Prototype Pollution via FormData Processing in Qwik City CVE-2026-25150 Fix available 9.3 CriticalFebruary 3, 2026
• qwik Qwik SSR XSS via Unsafe Virtual Node Serialization CVE-2026-25148 Fix available 5.3 MediumFebruary 3, 2026
• qwikdev qwik Crashing any Qwik Server CVE-2025-53620 Fix available 9.2 CriticalJuly 9, 2025
• qwik Cross-site Scripting (XSS) vulnerability due to improper HTML escaping in qwik CVE-2024-41677 Fix available 6.3 MediumAugust 6, 2024