@builder.io/qwik-city is the meta-framework for Qwik. When a Qwik Server Action QRL is executed it dynamically load the file containing the symbol. When an invalid qfunc is sent, the server does not handle the thrown error. The error then causes Node JS to exit. This vulnerability is fixed in 1.13.0.
When the Qwik City server receives a request to execute a Server Action QRL, it dynamically loads the file containing the appropriate symbol (qfunc). If an attacker sends an invalid qfunc value, the server throws an exception that is not caught or handled anywhere. The unhandled exception (CWE-248: Uncaught Exception) causes the Node.js runtime to completely terminate its process, resulting in application unavailability.
An attacker can remotely and without authentication cause an immediate shutdown of the Node.js process running the application, resulting in complete service unavailability (DoS). In environments without automatic process restart mechanisms, this results in permanent service failure.
Update the @builder.io/qwik-city package to version 1.13.0 or later, where the bug has been fixed. Details are available in the vendor's references on GitHub Security Advisories.
The @builder.io/qwik-city package in all versions before 1.13.0.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X