Executive brief
Qwik is a JavaScript framework used to build web applications. A vulnerability in Qwik Server allows an attacker to crash the web server by sending a specially crafted HTTP request with an invalid function reference, causing the entire service to go down without authentication required.
Technical details
This vulnerability is an unhandled exception (CWE-248) in Qwik's server-side action handling. When a Server Action QRL (Qwik Resource Locator) is executed, the framework dynamically loads the file containing the requested symbol. If an invalid or non-existent qfunc parameter is sent in an HTTP request, the server fails to catch the resulting error, causing Node.js to exit with an uncaught exception. The attack requires network reachability but no authentication or user interaction. An attacker can send a simple HTTP request with malformed qfunc, X-Qrl header, and payload to crash any Qwik Server instance. A fix is available in version 1.13.0 and later.
Affected products
- Builder.io Qwik < 1.13.0
Timeline
- 2025-07-09: disclosed
- 2025-07-09: patched: Fix released in version 1.13.0