ZeroDay Findings
Sign inSign up

Findings

CVE-2026-84994

Qwik is a performance-focused JavaScript framework.

Published Oct 13, 2026 · updated Oct 15, 2026 · QwikDev qwik

Qwik is a performance-focused JavaScript framework. Prior to @builder.io/qwik 1.20.0 and @qwik.dev/core 2.0.0-beta.37, default server-side qwik-json deserialization causes ResourceSerializer.$fill$ to pass resource._resolved to Promise.resolve without first rejecting attacker-controlled thenables. An unauthenticated request can provide a plain object whose then property is a QRL for an unregistered symbol, causing an orphaned asynchronous rejection that terminates Node.js under its default unhandled-rejection policy. A single request can crash a server, and repeated requests can keep replicas unavailable. This issue is fixed in @builder.io/qwik 1.20.0 and @qwik.dev/core 2.0.0-beta.37.

Code

The project this record applies to. Exploit listings stay in References.

Timeline

Detection, updates, and resolution for this record.

  1. Oct 13, 2026 · NIST NVD

    Detected

    Qwik is a performance-focused JavaScript framework. Prior to @builder.io/qwik 1.20.0 and @qwik.dev/core 2.0.0-beta.37, default server-side qwik-json deserialization causes ResourceSerializer.$fill$ to pass resource._resolved to Promise.resolve without first rejecting attacker-controlled thenables. An unauthenticated request can provide a plain object whose then property is a QRL for an unregistere

  2. Oct 14, 2026 · NIST NVD

    Updated

    Qwik is a performance-focused JavaScript framework. Prior to @builder.io/qwik 1.20.0 and @qwik.dev/core 2.0.0-beta.37, default server-side qwik-json deserialization causes ResourceSerializer.$fill$ to pass resource._resolved to Promise.resolve without first rejecting attacker-controlled thenables. An unauthenticated request can provide a plain object whose then property is a QRL for an unregistere

  3. Oct 15, 2026 · GitHub Advisory Database

    Fix available

    @builder.io/qwik fixed in 1.20.0; @qwik.dev/core fixed in 2.0.0-beta37

  4. Oct 15, 2026 · GitHub Advisory Database

    Fix available

    @builder.io/qwik fixed in 1.20.0

  5. Oct 15, 2026 · GitHub Advisory Database

    Fix available

    @qwik.dev/core fixed in 2.0.0-beta37

  6. Oct 15, 2026 · GitHub Advisory Database

    Updated

    ### Summary A Qwik server in the default configuration can be crashed with one unauthenticated HTTP request. During qwik-json body parsing, does . If is a plain object whose is a QRL for an unregistered symbol, the async QRL rejects, the rejection is orphaned, and Node terminates the process via its default unhandled-rejection policy. ### Impact One unauthenticated request crashes the server. Loop

Affected

  • npm @builder.ioversion unspecified
  • npm @builder.io/qwik0 → 1.20.0
  • npm @builder.io/qwik< 1.20.0
  • npm @qwik.devversion unspecified
  • npm @qwik.dev/core0 → 2.0.0-beta37
  • npm @qwik.dev/core< 2.0.0-beta37
  • vendor @builder.io qwikversion unspecified
  • vendor QwikDev qwikversion unspecified

Sources

  • CIRCL Vulnerability LookupVulnerability recordCVE-2026-84994

    Qwik is a performance-focused JavaScript framework. Prior to @builder.io/qwik 1.20.0 and @qwik.dev/core 2.0.0-beta.37, default server-side qwik-json deserialization causes ResourceSerializer.$fill$ to pass resource._resolved to Promise.resolve without first rejecting attacker-con

    vulnerability.circl.lu
  • CVE.orgVulnerability recordCVE-2026-84994

    Official CVE identifier

    cve.org
  • FIRST EPSSExploitation probabilityCVE-2026-84994

    30-day exploitation probability 0.5%

    first.org
  • GitHub Advisory DatabasePackage advisoryGHSA-x586-xvc8-g7q6

    GitHub Advisory Database record mirrored by OSV.

    github.com
  • GitLab Advisory DatabasePackage advisoryCVE-2026-84994

    A Qwik server in the default configuration can be crashed with one unauthenticated HTTP request. During qwik-json body parsing, ResourceSerializer.$fill$ does Promise.resolve(resource._resolved). If _resolved is a plain object whose .then is a QRL for an unregistered symbol, the async QRL rejects, the rejection is orphaned, and Node terminates the process via its default unhandled-rejection policy

    advisories.gitlab.com
  • NIST NVDVulnerability recordCVE-2026-84994

    Qwik is a performance-focused JavaScript framework. Prior to @builder.io/qwik 1.20.0 and @qwik.dev/core 2.0.0-beta.37, default server-side qwik-json deserialization causes ResourceSerializer.$fill$ to pass resource._resolved to Promise.resolve without first rejecting attacker-con

    nvd.nist.gov
  • OSV.devPackage advisoryGHSA-x586-xvc8-g7q6

    Qwik: Crashing any Qwik Server via Resource thenable

    osv.dev

References