# CVE-2026-84994: Qwik server denial of service via malformed Resource thenable

Source: https://junglewise.ai/threats/cve-2026-84994-qwik-crashing-any-qwik-server-via-resource-thenable  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-15. Updated: 2026-10-15  
License: CC BY 4.0 with a link back

CVE-2026-84994 · Severity: high · CVSS 4 · Published 2026-10-15

Qwik is a JavaScript framework for building web applications. An attacker can crash a Qwik server with a single unauthenticated HTTP request by sending a specially crafted request body that triggers an unhandled promise rejection in the resource parser. Repeated requests keep the server down, causing a denial of service to legitimate users.

Technologies: [@builder.io/qwik (npm)](https://junglewise.ai/threats/technologies/builder-io-qwik). Vendors: [Builder.Io](https://junglewise.ai/threats/vendors/builder-io), [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2026-84994 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-84994 being exploited in the wild.

**How severe is CVE-2026-84994?** High severity, with a CVSS score of 4, published 15 October 2026.

**Which products and versions are affected?** Builder.Io @Builder.Io/Qwik < 1.20.0; @builder.io/qwik (npm) < 1.20.0, SEMVER:introduced=0,fixed=1.20.0; @qwik.dev/core (npm) < 2.0.0-beta37, SEMVER:introduced=0,fixed=2.0.0-beta37; Qwik @Qwik.Dev/Core < 2.0.0-beta37.

**Is there a fix for CVE-2026-84994?** Yes. @builder.io/qwik (npm): upgrade to 1.20.0 or later; @qwik.dev/core (npm): upgrade to 2.0.0-beta37 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-84994 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-84994?** Check whether you run Builder.Io @Builder.Io/Qwik, @builder.io/qwik (npm), @qwik.dev/core (npm) or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- @builder.io/qwik (npm): upgrade to 1.20.0 or later

  ```sh
  npm install @builder.io/qwik@1.20.0
  ```

- @qwik.dev/core (npm): upgrade to 2.0.0-beta37 or later

  ```sh
  npm install @qwik.dev/core@2.0.0-beta37
  ```


## Technical details

During qwik-json body parsing, ResourceSerializer.$fill$ calls Promise.resolve() on a resource's _resolved property. If _resolved is a plain object with a .then method pointing to a QRL (Qwik Resource Location) for an unregistered symbol, the promise rejects and the rejection is left unhandled, causing Node.js to terminate the process via its default unhandled-rejection handler. The attack requires no authentication or user interaction and can be repeated to maintain downtime.

## Affected products

- Builder.io @builder.io/qwik < 1.20.0
- Qwik @qwik.dev/core < 2.0.0-beta37

## Identifiers

- CVE-2026-84994
- GHSA-x586-xvc8-g7q6

## Timeline

- 2026-09-22: disclosed: Published by security researcher simonkoeck
- 2026-10-15: advisory: GitHub Security Advisory GHSA-x586-xvc8-g7q6 published
- 2026-10-15: patched: Fixes released in @builder.io/qwik 1.20.0 and @qwik.dev/core 2.0.0-beta37

## References

- [https://api.github.com/users/simonkoeck](https://api.github.com/users/simonkoeck)

## Related threats

- [Qwik remote code execution via server$ deserialization](https://junglewise.ai/threats/cve-2026-27971-qwik-remote-code-execution-via-server-deserialization)
- [Qwik mutation XSS due to improper HTML escaping in SSR](https://junglewise.ai/threats/cve-2024-41677-qwik-mutation-xss-due-to-improper-html-escaping-in-ssr)
- [BuilderIO Qwik code injection in PureFunctionSerializer](https://junglewise.ai/threats/cve-2023-1283-builderio-qwik-code-injection-in-purefunctionserializer)
- [Builder.io Qwik cross-site scripting in attribute handling](https://junglewise.ai/threats/cve-2023-0410-builder-io-qwik-cross-site-scripting-in-attribute-handling)