CVE-2026-84994: Qwik: Crashing any Qwik Server via Resource thenable
Qwik is a performance-focused JavaScript framework. Prior to @builder.io/qwik 1.20.0 and @qwik.dev/core 2.0.0-beta.37, default server-side qwik-json deserialization causes ResourceSerializer.$fill$ to pass resource.resolved to Promise.resolve without first rejecting attacker-controlled thenables. An unauthenticated request can provide a plain object whose then property is a QRL for an unregistered symbol, causing an orphaned asynchronous rejection that terminates Node.js under its default unhandled-rejection policy. A single request can crash a server, and repeated requests can keep replicas unavailable. This issue is fixed in @builder.io/qwik 1.20.0 and @qwik.dev/core 2.0.0-beta.37.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
@builder.io/qwikto a version that resolves this vulnerability.Fixed in 1.20.0 - Upgrade
Upgrade
@qwik.dev/coreto a version that resolves this vulnerability.Fixed in 2.0.0-beta.37
Event History
Frequently Asked Questions
Which deployments are exposed?
Qwik server deployments using versions before @builder.io/qwik 1.20.0 or @qwik.dev/core 2.0.0-beta.37 are affected when using the default server-side qwik-json deserialization behavior.
Does an attacker need authentication or code execution to trigger the crash?
No. An unauthenticated attacker can trigger the issue with a single request containing a crafted plain object whose then property is a QRL for an unregistered symbol.
What is the operational impact of exploitation?
The crafted input causes an orphaned asynchronous rejection that terminates Node.js under its default unhandled-rejection policy. Repeated requests can keep server replicas unavailable.
What should be done to remediate the issue?
Upgrade to @builder.io/qwik 1.20.0 or later, or to @qwik.dev/core 2.0.0-beta.37 or later.