{"id":"ghsa-ghsa-x586-xvc8-g7q6","seq":2468,"kind":"advisory","title":"Qwik: Crashing any Qwik Server via Resource thenable","url":"https://github.com/advisories/GHSA-x586-xvc8-g7q6","permalink":"https://vulnpulse.app/items/ghsa-ghsa-x586-xvc8-g7q6","summary":"影響: npm:@builder.io/qwik < 1.20.0 → 1.20.0, npm:@qwik.dev/core < 2.0.0-beta37 → 2.0.0-beta37\nSummary A Qwik server in the default configuration can be crashed with one unauthenticated HTTP request. During qwik-json body parsing, ResourceSerializer.$fill$ does Promise.resolve(resource._resolved). If _resolved is a plain object whose .then is a QRL for an unregistered symbol, the async QRL rejects, the rejection is orphaned, and Node terminates the process via its default unhandled-rejection policy. Impact One unauthenticated request crashes the server. Looping keeps every replica dead a…","severity":"high","techs":["nodejs"],"cves":["CVE-2026-84994"],"tags":["GHSA-x586-xvc8-g7q6","@builder.io/qwik","@qwik.dev/core"],"source":{"id":"ghsa","name":"GitHub Advisory Database"},"published_at":"2026-10-15T20:22:00.000Z","fetched_at":"2026-10-21T16:17:46.637Z"}