CVE-2026-84994

Qwik is a performance-focused JavaScript framework. Prior to @builder.io/qwik 1.20.0 and @qwik.dev/core 2.0.0-beta.37, default server-side qwik-json deserialization causes ResourceSerializer.$fill$ to pass resource.resolved to Promise.resolve without first rejecting attacker-controlled thenables...

CVE-2026-84994 Qwik: Crashing any Qwik Server via Resource thenable

Qwik is a performance-focused JavaScript framework. Prior to @builder.io/qwik 1.20.0 and @qwik.dev/core 2.0.0-beta.37, default server-side qwik-json deserialization causes ResourceSerializer.$fill$ to pass resource.resolved to Promise.resolve without first rejecting attacker-controlled thenables...

CVE-2026-84994

The Qwik JavaScript framework is vulnerable in versions prior to @builder.io/qwik 1.20.0 and @qwik.dev/core 2.0.0-beta.37 . The root cause is a flaw in default server-side qwik-json deserialization where ResourceSerializer.$fill$ passes resource._resolved to Promise.resolve without rejecting atta...