CVE-2025-53620 CRITICAL

CVE-2025-53620: Crashing any Qwik Server

Vendor Qwikdev
Product qwik
Weakness CWE-248
Published July 9, 2025
Last update July 9, 2025
View on NVD All CVEs

CVSS base score

9.2/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction None
Confidentiality —
Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H

What the vulnerability does

01Description

@builder.io/qwik-city is the meta-framework for Qwik. When a Qwik Server Action QRL is executed it dynamically load the file containing the symbol. When an invalid qfunc is sent, the server does not handle the thrown error. The error then causes Node JS to exit. This vulnerability is fixed in 1.13.0.

Key dates

02Disclosure timeline

July 9, 2025 CVE published
July 9, 2025 Record updated