GHSA-X586-XVC8-G7Q6 Qwik: Crashing any Qwik Server via Resource thenable

Summary A Qwik server in the default configuration can be crashed with one unauthenticated HTTP request. During qwik-json body parsing, ResourceSerializer.$fill$ does Promise.resolveresource.resolved. If resolved is a plain object whose .then is a QRL for an unregistered symbol, the async QRL...