npm/@builder.io/qwik-city

Qwik City Open Redirect via fixTrailingSlash

Modified: 2/4/2026

@builder.io/qwik-city Cross-Site Request Forgery vulnerability

Modified: 11/8/2023

Qwik SSR XSS via Unsafe Virtual Node Serialization

Modified: 2/4/2026

Qwik's unhandled exception vulnerabilty can cause server crashes from malicious requests

Modified: 7/9/2025

Qwik City has a CSRF Protection Bypass via Content-Type Header Validation

Modified: 2/4/2026

Qwik City CSRF protection middleware does not work properly for content type header with parameters (eg. multipart/form-data)

Modified: 2/11/2026

Qwik City has array method pollution in FormData processing allows type confusion and DoS

Modified: 3/20/2026

Prototype Pollution via FormData Processing in Qwik City

Modified: 2/4/2026