Unauthenticated Denial of Service in Qwik Framework

The Qwik framework is susceptible to a denial-of-service (DoS) vulnerability tracked as CVE-2026-84994, affecting versions of @builder.io/qwik prior to 1.20.0 and @qwik.dev/core prior to 2.0.0-beta37. The issue arises during the parsing of qwik-json bodies within the ResourceSerializer.$fill$ function. When the framework processes a request containing a crafted object where the 'then' property is a QRL (Qwik URL) pointing to an unregistered symbol, the framework attempts to resolve the object as a promise. The resulting async rejection is not handled by the application, causing Node.js to trigger its default unhandled-rejection policy, which immediately terminates the process. Because the crash can be triggered by a single unauthenticated request, an attacker can maintain a persistent outage by continuously sending the exploit payload to any reachable Qwik-enabled endpoint.

Attack Chain

1. Attacker identifies a web application utilizing a vulnerable version of the Qwik framework.
2. Attacker crafts an HTTP request with a malformed qwik-json body.
3. Attacker embeds a 'thenable' object within the JSON payload containing a QRL reference to an unregistered symbol.
4. The application server receives the POST request and initiates parsing of the qwik-json body.
5. The ResourceSerializer.$fill$ logic attempts to resolve the provided 'thenable' object.
6. The underlying Node.js runtime fails to handle the asynchronous rejection triggered by the invalid QRL.
7. The Node.js process encounters an unhandled promise rejection and shuts down.
8. Service availability is lost for the affected server instance, leading to DoS.

Impact

The attack results in the immediate termination of the server process, rendering the application unavailable. In environments without robust process management or rapid restarts, this vulnerability enables an attacker to achieve a permanent denial-of-service state for the targeted application by continuously flooding the endpoint with the exploit payload. This affects all public-facing applications built on the vulnerable versions of the Qwik framework.

Recommendation

• Patch the vulnerability by upgrading @builder.io/qwik to version 1.20.0 or later, or @qwik.dev/core to 2.0.0-beta37 or later.
• Monitor web server logs for high frequencies of 500-series status codes coinciding with process restarts.
• Implement rate limiting at the WAF or reverse proxy level to mitigate the impact of the exploit while patching is pending.
• Ensure that the application runtime is configured to capture and log unhandled promise rejections for visibility, although this will not prevent the process crash.