CVE-2025-53620 Crashing any Qwik Server
An attacker can crash the Qwik server by sending an invalid server action QRL, causing a Node.js process exit.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-53620?
CVE-2025-53620 is a critical denial of service vulnerability in QwikDev qwik, published on 9 Jul 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
@builder.io/qwik-city is the meta-framework for Qwik. When a Qwik Server Action QRL is executed it dynamically load the file containing the symbol. When an invalid qfunc is sent, the server does not handle the thrown error. The error then causes Node JS to exit. This vulnerability is fixed in 1.13.0.
Weakness: CWE-248
Which versions are affected by CVE-2025-53620?
2 open source packages ship an affected version, including @builder.io/qwik-city.
| Package | Affected | Fixed in |
|---|---|---|
@builder.io/qwik-city npm | All versions | 1.13.0 |
@builder.io/qwik-city npm | All versions | 1.13.0 |
How do I fix CVE-2025-53620?
Upgrade @builder.io/qwik-city to 1.13.0 or later.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2025-53620 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-53620 exists.
Sources
Also known as GHSA-qr9h-j6xg-2j72.