https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2026-32701.htmlhttps://patchthecve.com/cve/CVE-2026-32701.htmlWed, 17 Jun 2026 10:36:14 +0000HIGH 7.5: Qwik is a performance-focused JavaScript framework. Versions prior to 1.19.2 improperly inferred arrays from dotted form field names during FormData parsing. By submitting mixed array-index and object-property keys for the same path, an attacker could cause user-controlled properties to be written ohttps://patchthecve.com/cve/CVE-2026-27971.htmlhttps://patchthecve.com/cve/CVE-2026-27971.htmlWed, 17 Jun 2026 10:27:59 +0000CRITICAL 9.8: Qwik is a performance focused javascript framework. qwik <=1.19.0 is vulnerable to RCE due to an unsafe deserialization vulnerability in the server$ RPC mechanism that allows any unauthenticated user to execute arbitrary code on the server with a single HTTP request. Affects any deployment where reqhttps://patchthecve.com/cve/CVE-2026-25155.htmlhttps://patchthecve.com/cve/CVE-2026-25155.htmlWed, 17 Jun 2026 10:24:12 +0000MEDIUM 5.9: Qwik is a performance focused javascript framework. Prior to version 1.12.0, a typo in the regular expression within isContentType causes incorrect parsing of certain Content-Type headers. This issue has been patched in version 1.12.0.https://patchthecve.com/cve/CVE-2026-25151.htmlhttps://patchthecve.com/cve/CVE-2026-25151.htmlWed, 17 Jun 2026 10:24:11 +0000MEDIUM 5.9: Qwik is a performance focused javascript framework. Prior to version 1.19.0, Qwik City’s server-side request handler inconsistently interprets HTTP request headers, which can be abused by a remote attacker to circumvent form submission CSRF protections using specially crafted or multi-valued Contenthttps://patchthecve.com/cve/CVE-2026-25150.htmlhttps://patchthecve.com/cve/CVE-2026-25150.htmlWed, 17 Jun 2026 10:24:11 +0000CRITICAL 9.3: Qwik is a performance focused javascript framework. Prior to version 1.19.0, a prototype pollution vulnerability exists in the formToObj() function within @builder.io/qwik-city middleware. The function processes form field names with dot notation (e.g., user.name) to create nested objects, but failshttps://patchthecve.com/cve/CVE-2026-25149.htmlhttps://patchthecve.com/cve/CVE-2026-25149.htmlWed, 17 Jun 2026 10:24:11 +0000MEDIUM 6.1: Qwik is a performance focused javascript framework. Prior to version 1.19.0, an Open Redirect vulnerability in Qwik City's default request handler middleware allows a remote attacker to redirect users to arbitrary protocol-relative URLs. Successful exploitation permits attackers to craft convincing https://patchthecve.com/cve/CVE-2026-25148.htmlhttps://patchthecve.com/cve/CVE-2026-25148.htmlWed, 17 Jun 2026 10:24:11 +0000MEDIUM 6.1: Qwik is a performance focused javascript framework. Prior to version 1.19.0, a Cross-Site Scripting vulnerability in Qwik.js' server-side rendering virtual attribute serialization allows a remote attacker to inject arbitrary web scripts into server-rendered pages via virtual attributes. Successful ehttps://patchthecve.com/cve/CVE-2024-41677.htmlhttps://patchthecve.com/cve/CVE-2024-41677.htmlWed, 17 Jun 2026 07:48:01 +0000MEDIUM 6.3: Qwik is a performance focused javascript framework. A potential mutation XSS vulnerability exists in Qwik for versions up to but not including 1.6.0. Qwik improperly escapes HTML on server-side rendering. It converts strings according to the rules found in the `render-ssr.ts` file. It sometimes caus