{"id":"EUVD-2026-99978","enisaUuid":"1bff8c0d-036d-3919-a178-4e1da219819e","description":"Qwik is a performance-focused JavaScript framework. Prior to @builder.io/qwik 1.20.0 and @qwik.dev/core 2.0.0-beta.37, default server-side qwik-json deserialization causes ResourceSerializer.$fill$ to pass resource._resolved to Promise.resolve without first rejecting attacker-controlled thenables. An unauthenticated request can provide a plain object whose then property is a QRL for an unregistered symbol, causing an orphaned asynchronous rejection that terminates Node.js under its default unhandled-rejection policy. A single request can crash a server, and repeated requests can keep replicas unavailable. This issue is fixed in @builder.io/qwik 1.20.0 and @qwik.dev/core 2.0.0-beta.37.","datePublished":"Oct 13, 2026, 7:00:53 PM","dateUpdated":"Oct 14, 2026, 4:36:19 PM","baseScore":8.7,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","references":"https://github.com/QwikDev/qwik/security/advisories/GHSA-x586-xvc8-g7q6\nhttps://github.com/QwikDev/qwik/pull/8655\nhttps://github.com/QwikDev/qwik/commit/c1e7444402f9592b5cf9096e10bf303ab4640511\nhttps://github.com/QwikDev/qwik/releases/tag/@builder.io/qwik@1.20.0\n","aliases":"CVE-2026-84994\nGHSA-x586-xvc8-g7q6\n","assigner":"GitHub_M","epss":0.52,"enisaIdProduct":[{"id":"3ec2da69-ee9b-3d3e-a2a3-faf923e82ea7","product":{"name":"qwik","vendor":{"name":"QwikDev"}},"product_version":"\u003c 2.0.0-beta37"},{"id":"ad792716-d3a5-32d9-b1cf-a34caab8ab4b","product":{"name":"qwik","vendor":{"name":"QwikDev"}},"product_version":"\u003c 1.20.0"}],"enisaIdVendor":[{"id":"3b604b8c-a1c3-384c-96bb-0a323e7d9c75","vendor":{"name":"QwikDev"}},{"id":"a6a236b7-eeb4-32c3-b216-72f95eb12584","vendor":{"name":"@builder.io"}}],"enisaIdVulnerability":[{"id":"0d9b92ad-cb35-379f-8065-4d05b59ff004","vulnerability":{"id":"CVE-2026-84994","description":"Qwik is a performance-focused JavaScript framework. Prior to @builder.io/qwik 1.20.0 and @qwik.dev/core 2.0.0-beta.37, default server-side qwik-json deserialization causes ResourceSerializer.$fill$ to pass resource._resolved to Promise.resolve without first rejecting attacker-controlled thenables. An unauthenticated request can provide a plain object whose then property is a QRL for an unregistered symbol, causing an orphaned asynchronous rejection that terminates Node.js under its default unhandled-rejection policy. A single request can crash a server, and repeated requests can keep replicas unavailable. This issue is fixed in @builder.io/qwik 1.20.0 and @qwik.dev/core 2.0.0-beta.37.","datePublished":"Oct 13, 2026, 7:00:53 PM","dateUpdated":"Oct 14, 2026, 4:36:19 PM","status":"PUBLISHED","baseScore":8.7,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","references":"https://github.com/QwikDev/qwik/security/advisories/GHSA-x586-xvc8-g7q6\nhttps://github.com/QwikDev/qwik/pull/8655\nhttps://github.com/QwikDev/qwik/commit/c1e7444402f9592b5cf9096e10bf303ab4640511\nhttps://github.com/QwikDev/qwik/releases/tag/@builder.io/qwik@1.20.0\n","enisa_id":"EUVD-2026-99978\n","assigner":"GitHub_M","epss":0.52,"dataProcessed":"Nov 7, 2026, 7:16:50 AM","vulnerabilityProduct":[{"id":"90670aee-af6d-3594-8eda-3b08b2bfd940","product":{"name":"qwik","vendor":{"name":"QwikDev"}},"product_version":"\u003c 2.0.0-beta37"},{"id":"c361a39f-4cb3-3a8e-b83c-62c0b266e75d","product":{"name":"qwik","vendor":{"name":"QwikDev"}},"product_version":"\u003c 1.20.0"}],"vulnerabilityVendor":[{"id":"2585575f-9b77-3a05-a4be-a32b7fe18d7a","vendor":{"name":"@builder.io"}},{"id":"4c19e581-c24d-33e1-b145-4722eb7742b7","vendor":{"name":"QwikDev"}}]}},{"id":"b01299cb-4941-38c4-9d38-d2643de38e0c","vulnerability":{"id":"GHSA-x586-xvc8-g7q6","description":"Qwik: Crashing any Qwik Server via Resource thenable","datePublished":"Oct 15, 2026, 8:22:00 PM","dateUpdated":"Oct 15, 2026, 8:22:00 PM","baseScore":0.0,"references":"https://github.com/QwikDev/qwik/security/advisories/GHSA-x586-xvc8-g7q6\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-84994\nhttps://github.com/QwikDev/qwik/pull/8655\nhttps://github.com/QwikDev/qwik/commit/c1e7444402f9592b5cf9096e10bf303ab4640511\nhttps://github.com/QwikDev/qwik\nhttps://github.com/QwikDev/qwik/releases/tag/@builder.io/qwik@1.20.0\n","enisa_id":"EUVD-2026-99978\n","aliases":"GHSA-x586-xvc8-g7q6\nCVE-2026-84994\n","epss":0.0,"dataProcessed":"Nov 1, 2026, 2:07:48 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}}],"enisaIdAdvisory":[]}