GHSA-x586-xvc8-g7q6: Npm/@qwik.dev/core vulnerability
Summary
A Qwik server in the default configuration can be crashed with one unauthenticated HTTP request. During qwik-json body parsing, ResourceSerializer.$fill$ does Promise.resolve(resource.resolved). If resolved is a plain object whose .then is a QRL for an unregistered symbol, the async QRL rejects, the rejection is orphaned, and Node terminates the process via its default unhandled-rejection policy.
Impact
One unauthenticated request crashes the server. Looping keeps every replica dead as long as the attacker sends requests.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
npm/@qwik.dev/coreto a version that resolves this vulnerability.Fixed in 2.0.0-beta37 - Upgrade
Upgrade
npm/@builder.io/qwikto a version that resolves this vulnerability.Fixed in 1.20.0
Event History
Frequently Asked Questions
Who can exploit this issue?
Any unauthenticated remote client that can send an HTTP request to a Qwik server is able to trigger the crash.
Are default deployments affected?
Yes. The issue is described as affecting a Qwik server in its default configuration during qwik-json body parsing.
What is the operational impact of repeated exploitation?
A single request terminates the Node process. An attacker can repeatedly send requests to keep every replica unavailable.