~ / search / GHSA-x586-xvc8-g7q6

GHSA-x586-xvc8-g7q6

Qwik: Crashing any Qwik Server via Resource thenable

Source: GitHub Advisory Database (reviewed) High CVE-2026-84994

Packages

EcosystemPackageAffectedFixed in
npm @builder.io/qwik < 1.20.0 1.20.0
npm @qwik.dev/core < 2.0.0-beta37 2.0.0-beta37

Details

As written in the advisory (Markdown source, shown as plain text).

### Summary A Qwik server in the default configuration can be crashed with one unauthenticated HTTP request. During qwik-json body parsing, `ResourceSerializer.$fill$` does `Promise.resolve(resource._resolved)`. If `_resolved` is a plain object whose `.then` is a QRL for an unregistered symbol, the async QRL rejects, the rejection is orphaned, and Node terminates the process via its default unhandled-rejection policy. ### Impact One unauthenticated request crashes the server. Looping keeps every replica dead as long as the attacker sends requests.

References

External links from the advisory. They lead to third-party sites.