CVE-2026-84994
Description
Qwik is a performance-focused JavaScript framework. Prior to @builder.io/qwik 1.20.0 and @qwik.dev/core 2.0.0-beta.37, default server-side qwik-json deserialization causes ResourceSerializer.$fill$ to pass resource._resolved to Promise.resolve without first rejecting attacker-controlled thenables. An unauthenticated request can provide a plain object whose then property is a QRL for an unregistered symbol, causing an orphaned asynchronous rejection that terminates Node.js under its default unhandled-rejection policy. A single request can crash a server, and repeated requests can keep replicas unavailable. This issue is fixed in @builder.io/qwik 1.20.0 and @qwik.dev/core 2.0.0-beta.37.
How to fix
- @builder.io/qwik1.20.0 or later
- @qwik.dev/core2.0.0-beta37 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| @builder.io/qwiknpm | v < 1.20.0 | 1.20.0 |
| @qwik.dev/corenpm | v < 2.0.0-beta37 | 2.0.0-beta37 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.