@builder.io/qwik-city

npm · Package

8 reports

Vulnerability alerts

Report	Product	Ecosystem	Severity	Fix status	Last updated
Qwik City has array method pollution in FormData processing allows type confusion and DoSCVE-2026-32701 · GHSA-WHHV-GG5V-864R	@builder.io/qwik-city	npm	High	Fix reported	2026-03-20
Qwik City CSRF protection middleware does not work properly for content type header with parameters (eg. multipart/form-data)CVE-2026-25155 · GHSA-VM6G-8R4H-22X8	@builder.io/qwik-city	npm	Medium	Fix reported	2026-02-11
Prototype Pollution via FormData Processing in Qwik CityCVE-2026-25150 · GHSA-XQG6-98CW-GXHQ	@builder.io/qwik-city	npm	Critical	Fix reported	2026-02-04
Qwik City has a CSRF Protection Bypass via Content-Type Header ValidationCVE-2026-25151 · GHSA-R666-8GJF-4V5F	@builder.io/qwik-city	npm	Medium	Fix reported	2026-02-04
Qwik City Open Redirect via fixTrailingSlashCVE-2026-25149 · GHSA-92J7-WGMG-F32M	@builder.io/qwik-city	npm	Low	Fix reported	2026-02-04
Qwik SSR XSS via Unsafe Virtual Node SerializationCVE-2026-25148 · GHSA-M6JQ-G7GQ-5W3C	@builder.io/qwik-city	npm	Medium	Fix reported	2026-02-04
Qwik's unhandled exception vulnerabilty can cause server crashes from malicious requestsCVE-2025-53620 · GHSA-QR9H-J6XG-2J72	@builder.io/qwik-city	npm	Critical	Fix reported	2025-07-10
@builder.io/qwik-city Cross-Site Request Forgery vulnerabilityCVE-2023-2307 · GHSA-C54W-7J5F-XG98	@builder.io/qwik-city	npm	Medium	Fix reported	2023-11-08