CVE-2026-84994: Qwik: Crashing any Qwik Server via Resource thenable
A Qwik server in the default configuration can be crashed with one unauthenticated HTTP request. During qwik-json body parsing, ResourceSerializer.$fill$ does Promise.resolve(resource._resolved). If _resolved is a plain object whose .then is a QRL for an unregistered symbol, the async QRL rejects, the rejection is orphaned, and Node terminates the process via its default unhandled-rejection policy.
References
- github.com/QwikDev/qwik/commit/c1e7444402f9592b5cf9096e10bf303ab4640511
- github.com/QwikDev/qwik/pull/8655
- github.com/QwikDev/qwik/releases/tag/@builder.io/qwik@1.20.0
- github.com/QwikDev/qwik/security/advisories/GHSA-x586-xvc8-g7q6
- github.com/advisories/GHSA-x586-xvc8-g7q6
- nvd.nist.gov/vuln/detail/CVE-2026-84994
Code Behaviors & Features
Detect and mitigate CVE-2026-84994 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →