GitHub Advisoryadvisory · npm

GHSA-x586-xvc8-g7q6 Qwik: Crashing any Qwik Server via Resource thenable

HIGH Published 2026-10-15 Modified 2026-10-15 Official page ↗
Aliases
CVE-2026-84994
Ecosystem
npm
Packages
@builder.io/qwik, @qwik.dev/core
Severity
High
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Weaknesses
CWE-248
Reviewed
2026-10-15

Affected packages

• npm @builder.io/qwik: < 1.20.0 → fixed in 1.20.0 • npm @qwik.dev/core: < 2.0.0-beta37 → fixed in 2.0.0-beta37

Description

Summary A Qwik server in the default configuration can be crashed with one unauthenticated HTTP request. During qwik-json body parsing, `ResourceSerializer.$fill$` does `Promise.resolve(resource._resolved)`. If `_resolved` is a plain object whose `.then` is a QRL for an unregistered symbol, the async QRL rejects, the rejection is orphaned, and Node terminates the process via its default unhandled-rejection policy. Impact One unauthenticated request crashes the server. Looping keeps every replica dead as long as the attacker sends requests.

Related

Alias · CVE (1)

  • CVE-2026-84994 Qwik is a performance-focused JavaScript framework. vulnerability

Weakness · CWE (1)

  • CWE-248 Uncaught Exception weakness

References