Qwik: Crashing any Qwik Server via Resource thenable
Summary
A Qwik server in the default configuration can be crashed with one unauthenticated HTTP request. During qwik-json body parsing, ResourceSerializer.$fill$ does Promise.resolve(resource._resolved). If _resolved is a plain object whose .then is a QRL for an unregistered symbol, the async QRL rejects, the rejection is orphaned, and Node terminates the process via its default unhandled-rejection policy.
Impact
One unauthenticated request crashes the server. Looping keeps every replica dead as long as the attacker sends requests.
What to do
Upgrade @builder.io/qwik to version 1.20.0 or higher, and @qwik.dev/core to version 2.0.0-beta37 or higher.
Affected software
Click a technology to see all vulnerabilities affecting it.
| Platform | Package | Vulnerable versions | Fixed in |
|---|---|---|---|
| npm package | @builder.io/qwik | < 1.20.0 | 1.20.0 |
| npm package | @qwik.dev/core | < 2.0.0-beta37 | 2.0.0-beta37 |
References
- https://github.com/QwikDev/qwik/security/advisories/GHSA-x586-xvc8-g7q6
- https://nvd.nist.gov/vuln/detail/CVE-2026-84994
- https://github.com/QwikDev/qwik/pull/8655
- https://github.com/QwikDev/qwik/commit/c1e7444402f9592b5cf9096e10bf303ab4640511
- https://github.com/QwikDev/qwik
- https://github.com/QwikDev/qwik/releases/tag/@builder.io/qwik@1.20.0
- CVSS vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N- Weakness (CWE)
CWE-248- Platform
- npm
- Package
@builder.io/qwik, @qwik.dev/core- Disclosed
- 15.10.2026
- Updated
- 20.10.2026 08:34
Sources and licenses · Edited or translated by DockRay; source rights and applicable licenses are retained.
OSV / GitHub Advisory Database - GHSA-x586-xvc8-g7q6 - CC BY 4.0
Vulnerability history: @qwik.dev/core
All published vulnerabilities of this package (npm package), newest first. Shows whether this is a one-off slip or a package that needs watching.
This is the only known vulnerability of this package.
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.