## Qwik: Crashing any Qwik Server via Resource thenable

- 種別: advisory
- 重大度: high
- 関連技術: nodejs
- CVE: CVE-2026-84994
- 公開日時: 2026-10-15T20:22:00.000Z
- 情報源: GitHub Advisory Database (https://github.com/advisories/GHSA-x586-xvc8-g7q6)
- パーマリンク: https://vulnpulse.app/items/ghsa-ghsa-x586-xvc8-g7q6

影響: npm:@builder.io/qwik < 1.20.0 → 1.20.0, npm:@qwik.dev/core < 2.0.0-beta37 → 2.0.0-beta37
Summary A Qwik server in the default configuration can be crashed with one unauthenticated HTTP request. During qwik-json body parsing, ResourceSerializer.$fill$ does Promise.resolve(resource._resolved). If _resolved is a plain object whose .then is a QRL for an unregistered symbol, the async QRL rejects, the rejection is orphaned, and Node terminates the process via its default unhandled-rejection policy. Impact One unauthenticated request crashes the server. Looping keeps every replica dead a…