All vulnerabilities
CVE-2026-84994GHSA-x586-xvc8-g7q6

@builder.io/qwik: Qwik: Crashing any Qwik Server via Resource thenable

QwikDev @builder.io/qwiknpmLibraries & packages
Open in ThreatlineRecord JSON
CVSS
8.7High
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.52%Chance of exploitation activity in the next 30 days, higher than 43% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in1.20.0Also 2.0.0-beta37GitHub
Published13 Oct 2026Updated 15 Oct 2026CVE List

What fixes it

  • 1.20.0@builder.io/qwik, npmGitHubnpm install @builder.io/qwik@1.20.0
  • 2.0.0-beta37@qwik.dev/core, npmGitHubnpm install @qwik.dev/core@2.0.0-beta37

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

Summary

A Qwik server in the default configuration can be crashed with one unauthenticated HTTP request. During qwik-json body parsing, ResourceSerializer.$fill$ does Promise.resolve(resource._resolved). If _resolved is a plain object whose .then is a QRL for an unregistered symbol, the async QRL rejects, the rejection is orphaned, and Node terminates the process via its default unhandled-rejection policy.

Impact

One unauthenticated request crashes the server. Looping keeps every replica dead as long as the attacker sends requests.

Text from GitHub Advisory Database

Affected versions 6

  • @builder.io/qwik, npm< 1.20.0GitHub
  • @qwik.dev/core, npm< 2.0.0-beta37GitHub
  • qwikaffected: < 2.0.0-beta37CVE List
  • qwikaffected: < 1.20.0CVE List
  • @builder.io/qwik, npmfrom first release, fixed in 1.20.0OSV
  • @qwik.dev/core, npmfrom first release, fixed in 2.0.0-beta37OSV

References 6