{"id":"CVE-2026-84994","aliases":["GHSA-x586-xvc8-g7q6"],"url":"https://o3.security/vulnerability/CVE-2026-84994","summary":"Qwik: Crashing any Qwik Server via Resource thenable","details":"Qwik is a performance-focused JavaScript framework. Prior to @builder.io/qwik 1.20.0 and @qwik.dev/core 2.0.0-beta.37, default server-side qwik-json deserialization causes ResourceSerializer.$fill$ to pass resource._resolved to Promise.resolve without first rejecting attacker-controlled thenables. An unauthenticated request can provide a plain object whose then property is a QRL for an unregistered symbol, causing an orphaned asynchronous rejection that terminates Node.js under its default unhandled-rejection policy. A single request can crash a server, and repeated requests can keep replicas unavailable. This issue is fixed in @builder.io/qwik 1.20.0 and @qwik.dev/core 2.0.0-beta.37.","published":"2026-10-13T19:00:53.742Z","modified":"2026-10-21T03:00:29.688494872Z","cvss":null,"epss":null,"cisaKev":null,"exploitsKnown":null,"affectedPackages":[{"ecosystem":"npm","name":"@builder.io/qwik","fixedVersion":"1.20.0"},{"ecosystem":"npm","name":"@qwik.dev/core","fixedVersion":"2.0.0-beta37"}],"fix":{"url":"https://github.com/QwikDev/qwik/commit/c1e7444402f9592b5cf9096e10bf303ab4640511","label":"QwikDev/qwik@c1e7444"},"references":[{"type":"WEB","url":"https://github.com/QwikDev/qwik/releases/tag/@builder.io/qwik@1.20.0"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/84xxx/CVE-2026-84994.json"},{"type":"ADVISORY","url":"https://github.com/QwikDev/qwik/security/advisories/GHSA-x586-xvc8-g7q6"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-84994"},{"type":"FIX","url":"https://github.com/QwikDev/qwik/commit/c1e7444402f9592b5cf9096e10bf303ab4640511"},{"type":"FIX","url":"https://github.com/QwikDev/qwik/pull/8655"},{"type":"PACKAGE","url":"https://github.com/QwikDev/qwik"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-10-21T03:00:29.688494872Z"}}