Quick answers
- Is CVE-2025-53620 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2025-53620 being exploited in the wild.
- How severe is CVE-2025-53620?
- Medium severity, with a CVSS score of 4, published 9 July 2025.
- Which products and versions are affected?
- @builder.io/qwik-city (npm) SEMVER:introduced=0,fixed=1.13.0.
- Is there a fix for CVE-2025-53620?
- Yes. @builder.io/qwik-city (npm): upgrade to 1.13.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2025-53620 attacked?
- It is attacked over the network, in a software library.
- Am I affected by CVE-2025-53620?
- Check whether you run @builder.io/qwik-city (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
How to fix
- @builder.io/qwik-city (npm): upgrade to 1.13.0 or later
npm install @builder.io/qwik-city@1.13.0
Technical details
This vulnerability is an unhandled exception (CWE-248) in Qwik's server-side action handling. When a Server Action QRL (Qwik Resource Locator) is executed, the framework dynamically loads the file containing the requested symbol. If an invalid or non-existent qfunc parameter is sent in an HTTP request, the server fails to catch the resulting error, causing Node.js to exit with an uncaught exception. The attack requires network reachability but no authentication or user interaction. An attacker can send a simple HTTP request with malformed qfunc, X-Qrl header, and payload to crash any Qwik Server instance. A fix is available in version 1.13.0 and later.
Affected products
- Builder.io Qwik < 1.13.0
Identifiers
- CVE-2025-53620
- GHSA-qr9h-j6xg-2j72
Timeline
- 2025-07-09: disclosed
- 2025-07-09: patched: Fix released in version 1.13.0