Qwik: Crashing any Qwik Server via Resource thenable

影響: npm:@builder.io/qwik < 1.20.0 → 1.20.0, npm:@qwik.dev/core < 2.0.0-beta37 → 2.0.0-beta37

A Qwik server in the default configuration can be crashed with one unauthenticated HTTP request. During qwik-json body parsing, ResourceSerializer.$fill$ does Promise.resolve(resource._resolved). If _resolved is a plain object whose .then is a QRL for an unregistered symbol, the async QRL rejects, the rejection is orphaned, and Node terminates the process via its default unhandled-rejection policy. Impact One unauthenticated request crashes the server. Looping keeps every replica dead a…

Read on GitHub Advisory Database

On 10/16/2026, 05:22 AM, GitHub Advisory Database published "Qwik: Crashing any Qwik Server via Resource thenable" (type: Advisory). Severity is "High" (high). Related technologies: JavaScript / Node.js. CVE: CVE-2026-84994.