Vulnerability GHSA-x586-xvc8-g7q6
High Risk
HIGH RISK
CVSS Score: 8.0
Score Range: 7.0–8.9
High severity vulnerabilities (CVSS 7.0–8.9). Serious vulnerabilities that should be prioritized soon after critical fixes.
5 hours ago
October 15, 2026 at 08:22 PM UTC
Qwik: Crashing any Qwik Server via Resource thenable
0.0.1-mono - 1.19.2
0.0.1-mono - 1.19.2
Summary
Qwik: Crashing any Qwik Server via Resource thenable
Details
Summary
A Qwik server in the default configuration can be crashed with one unauthenticated HTTP request. During qwik-json body parsing, ResourceSerializer.$fill$ does Promise.resolve(resource._resolved). If _resolved is a plain object whose .then is a QRL for an unregistered symbol, the async QRL rejects, the rejection is orphaned, and Node terminates the process via its default unhandled-rejection policy.
Impact
One unauthenticated request crashes the server. Looping keeps every replica dead as long as the attacker sends requests.
Related Vulnerabilities
Other vulnerabilities affecting the same packages
Critical
7 months ago
Qwik vulnerable to Unauthenticated RCE via server$ Deserialization
0.0.1-mono - 1.19.0 GHSA-p9x5-jp3h-96mm
0.0.1-mono - 1.19.0 GHSA-p9x5-jp3h-96mm
Medium Risk
2 years ago
Qwik has a potential mXSS vulnerability due to improper HTML escaping
0.0.1-mono - 1.7.2 GHSA-2rwj-7xq8-4gx4
0.0.1-mono - 1.7.2 GHSA-2rwj-7xq8-4gx4
Critical
3 years ago
builderio/qwik is vulnerable to code injection
0.0.1-mono - 0.20.1 GHSA-9wf9-qvvp-2929
0.0.1-mono - 0.20.1 GHSA-9wf9-qvvp-2929
Medium Risk
3 years ago
@builder.io/qwik vulnerable to Cross-site Scripting
0.0.1-mono - 0.16.1 GHSA-hm7f-rq7q-j9xp
0.0.1-mono - 0.16.1 GHSA-hm7f-rq7q-j9xp
Impacted packages
Timeline
Published
5 hours ago
October 15, 2026 at 08:22 PM UTC
Fixed (1.20.0)
4 months ago
May 22, 2026 at 08:21 AM UTC
Last Modified
5 hours ago
October 15, 2026 at 08:30 PM UTC