{"id":"GHSA-x586-xvc8-g7q6","revision":"79eb5925fb2c484abc97668e2a539d8f","records":[{"revision":"79eb5925fb2c484abc97668e2a539d8f","observedAt":"2026-10-24T13:17:17.793+00:00","statement":{"source":"osv","id":"GHSA-x586-xvc8-g7q6","aliases":["CVE-2026-84994"],"title":"Qwik: Crashing any Qwik Server via Resource thenable","description":"### Summary\n\nA Qwik server in the default configuration can be crashed with one unauthenticated HTTP request. During qwik-json body parsing, `ResourceSerializer.$fill$` does `Promise.resolve(resource._resolved)`. If `_resolved` is a plain object whose `.then` is a QRL for an unregistered symbol, the async QRL rejects, the rejection is orphaned, and Node terminates the process via its default unhandled-rejection policy.\n\n### Impact\n\nOne unauthenticated request crashes the server. Looping keeps every replica dead as long as the attacker sends requests.","state":0,"publishedAt":"2026-10-15T20:22:00+00:00","modifiedAt":"2026-10-15T20:30:03.9507415+00:00","affected":[{"ecosystem":"npm","name":"@builder.io/qwik","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"1.20.0"}]}],"versions":[],"rawVersionEvidence":null},{"ecosystem":"npm","name":"@qwik.dev/core","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"2.0.0-beta37"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[{"system":"CVSS_V4","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","score":null,"severity":null},{"system":"Publisher rating","vector":null,"score":null,"severity":"HIGH"}],"references":["https://github.com/QwikDev/qwik/security/advisories/GHSA-x586-xvc8-g7q6","https://nvd.nist.gov/vuln/detail/CVE-2026-84994","https://github.com/QwikDev/qwik/pull/8655","https://github.com/QwikDev/qwik/commit/c1e7444402f9592b5cf9096e10bf303ab4640511","https://github.com/QwikDev/qwik","https://github.com/QwikDev/qwik/releases/tag/@builder.io/qwik@1.20.0"],"sourceUrl":"https://github.com/advisories/GHSA-x586-xvc8-g7q6","license":"GitHub Advisory Database · CC-BY-4.0","key":"osv:GHSA-x586-xvc8-g7q6","identifiers":["GHSA-x586-xvc8-g7q6","CVE-2026-84994"]},"retained":false,"historicalAffected":[]}],"coverage":[]}