# CVE-2025-53620: Qwik unhandled exception denial of service

Source: https://junglewise.ai/threats/cve-2025-53620-qwik-unhandled-exception-denial-of-service  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2025-07-09. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2025-53620 · Severity: medium · CVSS 4 · Published 2025-07-09

Qwik is a JavaScript framework used to build web applications. A vulnerability in Qwik Server allows an attacker to crash the web server by sending a specially crafted HTTP request with an invalid function reference, causing the entire service to go down without authentication required.

Technologies: [@builder.io/qwik-city (npm)](https://junglewise.ai/threats/technologies/builder-io-qwik-city). Vendors: [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2025-53620 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2025-53620 being exploited in the wild.

**How severe is CVE-2025-53620?** Medium severity, with a CVSS score of 4, published 9 July 2025.

**Which products and versions are affected?** @builder.io/qwik-city (npm) SEMVER:introduced=0,fixed=1.13.0.

**Is there a fix for CVE-2025-53620?** Yes. @builder.io/qwik-city (npm): upgrade to 1.13.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2025-53620 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2025-53620?** Check whether you run @builder.io/qwik-city (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- @builder.io/qwik-city (npm): upgrade to 1.13.0 or later

  ```sh
  npm install @builder.io/qwik-city@1.13.0
  ```


## Technical details

This vulnerability is an unhandled exception (CWE-248) in Qwik's server-side action handling. When a Server Action QRL (Qwik Resource Locator) is executed, the framework dynamically loads the file containing the requested symbol. If an invalid or non-existent qfunc parameter is sent in an HTTP request, the server fails to catch the resulting error, causing Node.js to exit with an uncaught exception. The attack requires network reachability but no authentication or user interaction. An attacker can send a simple HTTP request with malformed qfunc, X-Qrl header, and payload to crash any Qwik Server instance. A fix is available in version 1.13.0 and later.

## Affected products

- Builder.io Qwik < 1.13.0

## Identifiers

- CVE-2025-53620
- GHSA-qr9h-j6xg-2j72

## Timeline

- 2025-07-09: disclosed
- 2025-07-09: patched: Fix released in version 1.13.0

## References

- [https://github.com/QwikDev/qwik/security/advisories/GHSA-qr9h-j6xg-2j72](https://github.com/QwikDev/qwik/security/advisories/GHSA-qr9h-j6xg-2j72)

## Related threats

- [Builder.io Qwik City array method pollution in FormData parsing](https://junglewise.ai/threats/cve-2026-32701-builder-io-qwik-city-array-method-pollution-in-formdata-parsing)
- [Qwik City CSRF protection middleware regex parsing bypass](https://junglewise.ai/threats/cve-2026-25155-qwik-city-csrf-protection-middleware-regex-parsing-bypass)
- [Qwik City open redirect in fixTrailingSlash middleware](https://junglewise.ai/threats/cve-2026-25149-qwik-city-open-redirect-in-fixtrailingslash-middleware)
- [Qwik City CSRF bypass via Content-Type header validation](https://junglewise.ai/threats/cve-2026-25151-qwik-city-csrf-bypass-via-content-type-header-validation)
- [Builder.io Qwik City prototype pollution in form processing](https://junglewise.ai/threats/cve-2026-25150-builder-io-qwik-city-prototype-pollution-in-form-processing)