Is CVE-2026-84994 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-84994 being exploited in the wild.

How severe is CVE-2026-84994?

High severity, with a CVSS score of 4, published 15 October 2026.

Which products and versions are affected?

Builder.Io @Builder.Io/Qwik < 1.20.0; @builder.io/qwik (npm) < 1.20.0, SEMVER:introduced=0,fixed=1.20.0; @qwik.dev/core (npm) < 2.0.0-beta37, SEMVER:introduced=0,fixed=2.0.0-beta37; Qwik @Qwik.Dev/Core < 2.0.0-beta37.

Is there a fix for CVE-2026-84994?

Yes. @builder.io/qwik (npm): upgrade to 1.20.0 or later; @qwik.dev/core (npm): upgrade to 2.0.0-beta37 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-84994 attacked?

It is attacked over the network.

Am I affected by CVE-2026-84994?

Check whether you run Builder.Io @Builder.Io/Qwik, @builder.io/qwik (npm), @qwik.dev/core (npm) or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-84994: Qwik server denial of service via malformed Resource thenable

Q: Is there a fix for CVE-2026-84994?

Yes. @builder.io/qwik (npm): upgrade to 1.20.0 or later; @qwik.dev/core (npm): upgrade to 2.0.0-beta37 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-84994 attacked?

It is attacked over the network.

Q: Am I affected by CVE-2026-84994?

Check whether you run Builder.Io @Builder.Io/Qwik, @builder.io/qwik (npm), @qwik.dev/core (npm) or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-84994 · Severity: high · CVSS 4 · Published 2026-10-15

Qwik is a JavaScript framework for building web applications. An attacker can crash a Qwik server with a single unauthenticated HTTP request by sending a specially crafted request body that triggers an unhandled promise rejection in the resource parser. Repeated requests keep the server down, causing a denial of service to legitimate users.

Technologies: @builder.io/qwik (npm). Vendors: Builder.Io, npm.

Quick answers

Is CVE-2026-84994 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-84994 being exploited in the wild.
How severe is CVE-2026-84994?: High severity, with a CVSS score of 4, published 15 October 2026.
Which products and versions are affected?: Builder.Io @Builder.Io/Qwik < 1.20.0; @builder.io/qwik (npm) < 1.20.0, SEMVER:introduced=0,fixed=1.20.0; @qwik.dev/core (npm) < 2.0.0-beta37, SEMVER:introduced=0,fixed=2.0.0-beta37; Qwik @Qwik.Dev/Core < 2.0.0-beta37.
Is there a fix for CVE-2026-84994?: Yes. @builder.io/qwik (npm): upgrade to 1.20.0 or later; @qwik.dev/core (npm): upgrade to 2.0.0-beta37 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-84994 attacked?: It is attacked over the network.
Am I affected by CVE-2026-84994?: Check whether you run Builder.Io @Builder.Io/Qwik, @builder.io/qwik (npm), @qwik.dev/core (npm) or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

@builder.io/qwik (npm): upgrade to 1.20.0 or later
```
npm install @builder.io/qwik@1.20.0
```
@qwik.dev/core (npm): upgrade to 2.0.0-beta37 or later
```
npm install @qwik.dev/core@2.0.0-beta37
```

Technical details

During qwik-json body parsing, ResourceSerializer.$fill$ calls Promise.resolve() on a resource's _resolved property. If _resolved is a plain object with a .then method pointing to a QRL (Qwik Resource Location) for an unregistered symbol, the promise rejects and the rejection is left unhandled, causing Node.js to terminate the process via its default unhandled-rejection handler. The attack requires no authentication or user interaction and can be repeated to maintain downtime.

Affected products

Builder.io @builder.io/qwik < 1.20.0
Qwik @qwik.dev/core < 2.0.0-beta37

Identifiers

CVE-2026-84994
GHSA-x586-xvc8-g7q6

Timeline

2026-09-22: disclosed: Published by security researcher simonkoeck
2026-10-15: advisory: GitHub Security Advisory GHSA-x586-xvc8-g7q6 published
2026-10-15: patched: Fixes released in @builder.io/qwik 1.20.0 and @qwik.dev/core 2.0.0-beta37

References

https://api.github.com/users/simonkoeck

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.