EUVD-2026-99978

Qwik: Crashing any Qwik Server via Resource thenable...

CVE-2026-84994

Qwik is a performance-focused JavaScript framework. Prior to @builder.io/qwik 1.20.0 and @qwik.dev/core 2.0.0-beta.37, default server-side qwik-json deserialization causes ResourceSerializer.$fill$ to pass resource.resolved to Promise.resolve without first rejecting attacker-controlled thenables...

CVE-2026-84994

Qwik is a performance-focused JavaScript framework. Prior to @builder.io/qwik 1.20.0 and @qwik.dev/core 2.0.0-beta.37, default server-side qwik-json deserialization causes ResourceSerializer.$fill$ to pass resource.resolved to Promise.resolve without first rejecting attacker-controlled thenables...

CVE-2026-84994: Uncaught Exception

Qwik is a performance-focused JavaScript framework. Prior to @builder.io/qwik 1.20.0 and @qwik.dev/core 2.0.0-beta.37, default server-side qwik-json deserialization causes ResourceSerializer.$fill$ to pass resource.resolved to Promise.resolve without first rejecting attacker-controlled thenables...

PT-2026-112710

Name of the Vulnerable Software and Affected Versions @builder.io/qwik versions prior to 1.20.0 @qwik.dev/core versions prior to 2.0.0-beta.37 Description Default server-side qwik-json deserialization allows an unauthenticated request to provide a plain object where the then property is a QRL for...