CVE-2026-84994

UNKNOWN 0.0

Qwik: Crashing any Qwik Server via Resource thenable

CVSS Score

0.0

EPSS Score

0.0%

EPSS Percentile

0th

Qwik is a performance-focused JavaScript framework. Prior to @builder.io/qwik 1.20.0 and @qwik.dev/core 2.0.0-beta.37, default server-side qwik-json deserialization causes ResourceSerializer.$fill$ to pass resource._resolved to Promise.resolve without first rejecting attacker-controlled thenables. An unauthenticated request can provide a plain object whose then property is a QRL for an unregistered symbol, causing an orphaned asynchronous rejection that terminates Node.js under its default unhandled-rejection policy. A single request can crash a server, and repeated requests can keep replicas unavailable. This issue is fixed in @builder.io/qwik 1.20.0 and @qwik.dev/core 2.0.0-beta.37.

CWE	CWE-248
Vendor	qwikdev
Product	qwik
Published	Oct 13, 2026

Stay Ahead of the Next One

Get instant alerts for qwikdev qwik

Be the first to know when new unknown vulnerabilities affecting qwikdev qwik are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

Affected Versions

QwikDev / qwik

< 2.0.0-beta37

@builder.io / qwik

< 1.20.0

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/QwikDev/qwik/security/advisories/GHSA-x586-xvc8-g7q6 github.com: https://github.com/QwikDev/qwik/pull/8655 github.com: https://github.com/QwikDev/qwik/commit/c1e7444402f9592b5cf9096e10bf303ab4640511 github.com: https://github.com/QwikDev/qwik/releases/tag/@builder.io/[email protected]