CVE-2026-84994: Qwik Server Crash via Resource Thenable
Summary
CVE-2026-84994: Qwik: Crashing any Qwik Server via Resource thenable. Affects @builder.io/qwik versions < 1.20.0. Fixed in 1.20.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Qwik is a framework designed for building fast, optimized web applications. It allows developers to create applications that load quickly and efficiently by utilizing a unique approach to rendering and resource management. However, a vulnerability has been identified that can cause a Qwik server to crash under certain conditions, specifically when handling unauthenticated HTTP requests.
Vulnerability Detail
The vulnerability arises during the parsing of qwik-json bodies, where the method ResourceSerializer.$fill$ calls Promise.resolve(resource._resolved). If the _resolved property is a plain object with a .then method that points to an unregistered QRL symbol, the resulting promise will reject. This rejection is orphaned, leading to Node.js terminating the process due to its default unhandled-rejection policy. The impact is significant, as an attacker can crash the server with a single unauthenticated request, causing all replicas to become unresponsive if the requests are sent in a loop.
How To Fix
Minimum fixed version
1.20.0
This is the first release that contains the fix.
npm install @builder.io/qwik@1.20.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can implement rate limiting on your server to mitigate the impact of potential attacks. This can be done using middleware in your server configuration to limit the number of requests from a single IP address within a specified timeframe.
Conclusion
The CVE-2026-84994 vulnerability poses a serious risk to Qwik servers, allowing attackers to crash them with unauthenticated requests. It is crucial for developers using the affected packages to update to the latest versions to mitigate this risk. Additionally, implementing rate limiting can serve as a temporary measure to protect against potential attacks.
See every vulnerability recorded for @builder.io/qwik →
FAQ
CVE-2026-84994 is a vulnerability in the Qwik framework that allows an attacker to crash a Qwik server with a single unauthenticated HTTP request.
If your application uses the affected versions of Qwik, it can be crashed by an attacker, leading to downtime and potential service disruption.
You should immediately update to the patched versions of the affected packages to protect your application from this vulnerability.
Yes, you can use Vulert to monitor your application for open-source vulnerabilities in real-time. It analyzes your package-lock.json file to alert you of any issues.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
References
Related vulnerabilities
Recent vulnerabilities recorded for @builder.io/qwik.
