QwikDev vulnerabilities
We track 6 vulnerabilities in QwikDev products. 6 are rated high or critical, and none are known to be exploited. The most recent was published on October 13, 2026.
Latest QwikDev vulnerabilities
- 8.7 High severity
qwik: Uncaught Exception
Qwik is a performance-focused JavaScript framework. Prior to @builder.io/qwik 1.20.0 and @qwik.dev/core 2.0.0-beta.37, default server-side qwik-json deserialization causes ResourceSerializer.$fill$ to pass resource._resolved to Promise.resolve without first re
- 7.5 High severity
qwik: Access of Resource Using Incompatible Type
Qwik is a performance-focused JavaScript framework. Versions prior to 1.19.2 improperly inferred arrays from dotted form field names during FormData parsing. By submitting mixed array-index and object-property keys for the same path, an attacker could cause us
- 9.8 Critical severity
qwik: Deserialization of Untrusted Data
Qwik is a performance focused javascript framework. qwik <=1.19.0 is vulnerable to RCE due to an unsafe deserialization vulnerability in the server$ RPC mechanism that allows any unauthenticated user to execute arbitrary code on the server with a single HTTP r
- 7.1 High severity
qwik: Cross-Site Request Forgery
Qwik is a performance focused javascript framework. Prior to version 1.12.0, a typo in the regular expression within isContentType causes incorrect parsing of certain Content-Type headers. This issue has been patched in version 1.12.0.
- 10.0 Critical severity
qwik: Improperly Controlled Modification of Object Prototype Attributes
Qwik is a performance focused javascript framework. Prior to version 1.19.0, a prototype pollution vulnerability exists in the formToObj() function within @builder.io/qwik-city middleware. The function processes form field names with dot notation (e.g., user.n
- 9.2 Critical severity
qwik: Uncaught Exception
@builder.io/qwik-city is the meta-framework for Qwik. When a Qwik Server Action QRL is executed it dynamically load the file containing the symbol. When an invalid qfunc is sent, the server does not handle the thrown error. The error then causes Node JS to exi