Qwik: Denial of service via unhandled rejection in resource deserialization
Summary
Qwik is a performance-focused JavaScript framework. Before the fixed versions, default server-side deserialization of resource data did not reject attacker-controlled thenable objects. An unauthenticated HTTP request can trigger an orphaned asynchronous rejection that terminates a Node.js server under its default unhandled-rejection policy. A single request can crash the server, and repeated requests can keep replicas unavailable. Confidentiality and integrity are not affected.
Affected
- @builder.io/qwik before 1.20.0
- @qwik.dev/core before 2.0.0-beta.37
Fixed in
- @builder.io/qwik 1.20.0
- @qwik.dev/core 2.0.0-beta.37
Workaround
Unknown. No workaround is documented in the sources. Upgrading is the remedy.
Exploitation
- No evidence of exploitation in the wild found in the sources.
- CISA SSVC: exploitation none, automatable yes, technical impact partial.
- No public proof of concept known.
Our recommendation
- Inventory Qwik projects and lockfiles for @builder.io/qwik and @qwik.dev/core.
- Upgrade to 1.20.0 or 2.0.0-beta.37 or later.
- Check whether any Node.js-hosted Qwik application is reachable from the internet.
- Run Node.js under a process supervisor that restarts crashed workers, and alert on restart spikes.
- Limit exposure of untrusted traffic until patching is complete.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- GitHub Security Advisory GHSA-x586-xvc8-g7q6 github.com
- Qwik release @builder.io/qwik@1.20.0 github.com
- Fix commit c1e7444402f9592b5cf9096e10bf303ab4640511 github.com
- Pull request #8655 github.com
- OSV entry CVE-2026-84994 osv.dev
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 04:17.
Original description (NVD)
Qwik is a performance-focused JavaScript framework. Prior to @builder.io/qwik 1.20.0 and @qwik.dev/core 2.0.0-beta.37, default server-side qwik-json deserialization causes ResourceSerializer.$fill$ to pass resource._resolved to Promise.resolve without first rejecting attacker-controlled thenables. An unauthenticated request can provide a plain object whose then property is a QRL for an unregistered symbol, causing an orphaned asynchronous rejection that terminates Node.js under its default unhandled-rejection policy. A single request can crash a server, and repeated requests can keep replicas unavailable. This issue is fixed in @builder.io/qwik 1.20.0 and @qwik.dev/core 2.0.0-beta.37.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.