CVE-2026-84994

Awaiting Analysis Awaiting Analysis - Queue

Prototype Pollution in Qwik Framework

Publication date: 2026-10-13

Last updated on: 2026-10-14

Assigner: GitHub, Inc.

Description

Qwik is a performance-focused JavaScript framework. Prior to @builder.io/qwik 1.20.0 and @qwik.dev/core 2.0.0-beta.37, default server-side qwik-json deserialization causes ResourceSerializer.$fill$ to pass resource._resolved to Promise.resolve without first rejecting attacker-controlled thenables. An unauthenticated request can provide a plain object whose then property is a QRL for an unregistered symbol, causing an orphaned asynchronous rejection that terminates Node.js under its default unhandled-rejection policy. A single request can crash a server, and repeated requests can keep replicas unavailable. This issue is fixed in @builder.io/qwik 1.20.0 and @qwik.dev/core 2.0.0-beta.37.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-13

Last Modified

2026-10-14

Generated

2026-10-19

AI Q&A

2026-10-14

EPSS Evaluated

2026-10-18

NVD

CVE-2026-84994

EUVD

EUVD-2026-99978

Affected Vendors & Products

Vendor	Product	Version / Range
QwikDev	qwik	< 2.0.0-beta37
@builder.io	qwik	< 1.20.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-248	An exception is thrown from a function, but it is not caught.

Attack-Flow Graph

Executive Summary

This vulnerability affects Qwik, a JavaScript framework, before versions 1.20.0 and 2.0.0-beta.37. It involves improper handling of deserialized resources where attacker-controlled objects with a .then property can trigger unhandled promise rejections. This causes Node.js to crash under its default policy, leading to denial of service.

Detection Guidance

Detecting this vulnerability requires checking the Qwik framework version in use. Run 'npm list @builder.io/qwik' or 'npm list @qwik.dev/core' in your project directory. If the version is below 1.20.0 for @builder.io/qwik or 2.0.0-beta.37 for @qwik.dev/core, the system is vulnerable.

Impact Analysis

An attacker can send a single malicious request to crash your Qwik server. Repeated attacks can keep the server down indefinitely, causing downtime and disrupting service availability for users.

Compliance Impact

This vulnerability primarily impacts system availability by causing server crashes through denial-of-service attacks. It does not directly affect data confidentiality or integrity, which are key concerns for GDPR and HIPAA compliance. However, repeated crashes could lead to prolonged service unavailability, potentially violating availability requirements in these regulations.

Mitigation Strategies

Upgrade to Qwik version 1.20.0 or later for @builder.io/qwik, or 2.0.0-beta.37 or later for @qwik.dev/core. This can be done via npm using 'npm install @builder.io/qwik@latest' or 'npm install @qwik.dev/core@latest'.

Hi! I’m here to help you understand CVE-2026-84994. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70