qwik — Vulnerabilities & Security Advisories 9

All 9 CVE vulnerabilities found in qwik, with AI-generated Chinese analysis, references, and POCs.

CVE ID	Title	CVSS	Severity	Published
CVE-2026-32701	Qwik has array method pollution in FormData processing, allowing type confusion and DoS CWE-843	7.5	High	2026-03-20
CVE-2026-27971	Qwik affected by unauthenticated RCE via server$ Deserialization CWE-502	9.8^AI	Critical^AI	2026-03-03
CVE-2026-25150	Prototype Pollution via FormData Processing in Qwik City CWE-1321	9.3	Critical	2026-02-03
CVE-2026-25148	Qwik SSR XSS via Unsafe Virtual Node Serialization CWE-79	6.1^AI	Medium^AI	2026-02-03
CVE-2026-25151	Qwik City has a CSRF Protection Bypass via Content-Type Header Validation CWE-352	5.9	Medium	2026-02-03
CVE-2026-25155	[qwik-city] CSRF protection middleware does not work properly for content type header with parameters (eg. multipart/form-data) CWE-352	5.9	Medium	2026-02-03
CVE-2026-25149	Qwik City Open Redirect via fixTrailingSlash CWE-601	6.1^AI	Medium^AI	2026-02-03
CVE-2025-53620	Crashing any Qwik Server CWE-248	7.5^AI	High^AI	2025-07-09
CVE-2024-41677	Cross-site Scripting (XSS) vulnerability due to improper HTML escaping in qwik CWE-79	6.3	Medium	2024-08-06

All 9 known CVE vulnerabilities affecting qwik with full Chinese analysis, references, and POCs where available.