Qwik CVE-2026-84994

Exploitation requires the target to run Qwik server-side rendering with default server-side qwik-json deserialization enabled on an affected version (@builder.io/qwik < 1.20.0 or @qwik.dev/core < 2.0.0-beta.37), and relies on Node.js running under its default unhandled-rejection policy (process termination on unhandled rejection). The specific trigger is a deserialized resource value that is a thenable - a plain object with a 'then' property that is a QRL for an unregistered symbol. No authentication, user interaction, or non-default configuration is needed (PR:N/UI:N), so the main limiting factor is that the deployment must be an exposed Qwik SSR endpoint reachable by the attacker; environments that override Node's default unhandled-rejection behavior (e.g. a global handler or --unhandled-rejections=warn) would blunt the crash.

This is a genuine availability-only denial-of-service flaw whose risk profile is driven entirely by ease of exploitation rather than impact breadth. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) describes a network-reachable, low-complexity, unauthenticated attack with no user interaction, and the impact metrics confirm it is purely availability (VA:H) with zero confidentiality or integrity effect (VC:N/VI:N), consistent with CWE-248 (uncaught exception) and the described Node.js crash. The score of 8.7 (High) is justified for an unauthenticated single-request crash primitive, but it should be read as a pure uptime/DoS risk, not a code-execution or data-exposure risk. No EPSS score was provided, so statistical exploitation likelihood cannot be quantified; the CVE is NOT in CISA KEV and no public exploit code is referenced, so there is no public exploit identified at time of analysis. SSVC inputs are not supplied, but the technical nature strongly implies the attack is automatable (a crafted JSON body is trivially scriptable) with technical impact limited to a service crash. Net assessment: patch promptly for internet-facing Qwik SSR deployments because exploitation is trivial and repeatable, but prioritize below any confidentiality/integrity-impacting vulnerabilities since the worst outcome is service unavailability. Missing signals to verify: EPSS and any vendor claim of active exploitation - none present in the data.

An unauthenticated attacker sends an HTTP request to a Qwik server-side-rendered endpoint containing a crafted qwik-json payload whose resource value is a plain object with a 'then' property set to a QRL for an unregistered symbol. During deserialization ResourceSerializer.$fill$ passes this attacker-controlled thenable to Promise.resolve, producing an orphaned asynchronous rejection that, under Node.js's default unhandled-rejection policy, terminates the process. No public exploit code is referenced, but the payload is simple and a single request crashes the server, with repeated requests keeping replicas down.