EUVD-2026-99978

Qwik: Crashing any Qwik Server via Resource thenable...

Qwik: Crashing any Qwik Server via Resource thenable

Summary A Qwik server in the default configuration can be crashed with one unauthenticated HTTP request. During qwik-json body parsing, ResourceSerializer.$fill$ does Promise.resolveresource.resolved. If resolved is a plain object whose .then is a QRL for an unregistered symbol, the async QRL...

GHSA-X586-XVC8-G7Q6 Qwik: Crashing any Qwik Server via Resource thenable

Summary A Qwik server in the default configuration can be crashed with one unauthenticated HTTP request. During qwik-json body parsing, ResourceSerializer.$fill$ does Promise.resolveresource.resolved. If resolved is a plain object whose .then is a QRL for an unregistered symbol, the async QRL...

CVE-2026-84994

Qwik is a performance-focused JavaScript framework. Prior to @builder.io/qwik 1.20.0 and @qwik.dev/core 2.0.0-beta.37, default server-side qwik-json deserialization causes ResourceSerializer.$fill$ to pass resource.resolved to Promise.resolve without first rejecting attacker-controlled thenables...

CVE-2026-84994 Qwik: Crashing any Qwik Server via Resource thenable

Qwik is a performance-focused JavaScript framework. Prior to @builder.io/qwik 1.20.0 and @qwik.dev/core 2.0.0-beta.37, default server-side qwik-json deserialization causes ResourceSerializer.$fill$ to pass resource.resolved to Promise.resolve without first rejecting attacker-controlled thenables...

CVE-2026-84994

The Qwik JavaScript framework is vulnerable in versions prior to @builder.io/qwik 1.20.0 and @qwik.dev/core 2.0.0-beta.37 . The root cause is a flaw in default server-side qwik-json deserialization where ResourceSerializer.$fill$ passes resource._resolved to Promise.resolve without rejecting atta...

CVE-2026-84994

Qwik is a performance-focused JavaScript framework. Prior to @builder.io/qwik 1.20.0 and @qwik.dev/core 2.0.0-beta.37, default server-side qwik-json deserialization causes ResourceSerializer.$fill$ to pass resource.resolved to Promise.resolve without first rejecting attacker-controlled thenables...

CVE-2026-84994 Qwik: Crashing any Qwik Server via Resource thenable

Qwik is a performance-focused JavaScript framework. Prior to @builder.io/qwik 1.20.0 and @qwik.dev/core 2.0.0-beta.37, default server-side qwik-json deserialization causes ResourceSerializer.$fill$ to pass resource.resolved to Promise.resolve without first rejecting attacker-controlled thenables...

CVE-2026-84994 Qwik: Crashing any Qwik Server via Resource thenable

Qwik is a performance-focused JavaScript framework. Prior to @builder.io/qwik 1.20.0 and @qwik.dev/core 2.0.0-beta.37, default server-side qwik-json deserialization causes ResourceSerializer.$fill$ to pass resource.resolved to Promise.resolve without first rejecting attacker-controlled thenables...

CVE-2026-84994: Uncaught Exception

Qwik is a performance-focused JavaScript framework. Prior to @builder.io/qwik 1.20.0 and @qwik.dev/core 2.0.0-beta.37, default server-side qwik-json deserialization causes ResourceSerializer.$fill$ to pass resource.resolved to Promise.resolve without first rejecting attacker-controlled thenables...

PT-2026-112710

Name of the Vulnerable Software and Affected Versions @builder.io/qwik versions prior to 1.20.0 @qwik.dev/core versions prior to 2.0.0-beta.37 Description Default server-side qwik-json deserialization allows an unauthenticated request to provide a plain object where the then property is a QRL for...

Qwik Dev: Improper exception handling leads to vulnerabilities

Qwik Dev Qwik has a vulnerability related to improper exception handling. This vulnerability stems from the default serialization process of qwik-json on the server side, which does not first reject the thenable controlled by the attacker. As a result, ResourceSerializer.$fill passes...