{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/qwik-core--2.0.0-beta37/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:builder.io:qwik:*:*:*:*:*:*:*:*"],"_cs_cves":[{"id":"CVE-2026-84994"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Qwik (\u003c 1.20.0)","Qwik Core (\u003c 2.0.0-beta37)"],"_cs_severities":["medium"],"_cs_tags":["denial-of-service","webserver","application-vulnerability"],"_cs_type":"advisory","_cs_vendors":["Builder.io"],"content_html":"\u003cp\u003eThe Qwik framework is susceptible to a denial-of-service (DoS) vulnerability tracked as CVE-2026-84994, affecting versions of @builder.io/qwik prior to 1.20.0 and @qwik.dev/core prior to 2.0.0-beta37. The issue arises during the parsing of qwik-json bodies within the \u003ccode\u003eResourceSerializer.$fill$\u003c/code\u003e function. When the framework processes a request containing a crafted object where the 'then' property is a QRL (Qwik URL) pointing to an unregistered symbol, the framework attempts to resolve the object as a promise. The resulting async rejection is not handled by the application, causing Node.js to trigger its default unhandled-rejection policy, which immediately terminates the process. Because the crash can be triggered by a single unauthenticated request, an attacker can maintain a persistent outage by continuously sending the exploit payload to any reachable Qwik-enabled endpoint.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAttacker identifies a web application utilizing a vulnerable version of the Qwik framework.\u003c/li\u003e\n\u003cli\u003eAttacker crafts an HTTP request with a malformed qwik-json body.\u003c/li\u003e\n\u003cli\u003eAttacker embeds a 'thenable' object within the JSON payload containing a QRL reference to an unregistered symbol.\u003c/li\u003e\n\u003cli\u003eThe application server receives the POST request and initiates parsing of the qwik-json body.\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003eResourceSerializer.$fill$\u003c/code\u003e logic attempts to resolve the provided 'thenable' object.\u003c/li\u003e\n\u003cli\u003eThe underlying Node.js runtime fails to handle the asynchronous rejection triggered by the invalid QRL.\u003c/li\u003e\n\u003cli\u003eThe Node.js process encounters an unhandled promise rejection and shuts down.\u003c/li\u003e\n\u003cli\u003eService availability is lost for the affected server instance, leading to DoS.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eThe attack results in the immediate termination of the server process, rendering the application unavailable. In environments without robust process management or rapid restarts, this vulnerability enables an attacker to achieve a permanent denial-of-service state for the targeted application by continuously flooding the endpoint with the exploit payload. This affects all public-facing applications built on the vulnerable versions of the Qwik framework.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003ePatch the vulnerability by upgrading @builder.io/qwik to version 1.20.0 or later, or @qwik.dev/core to 2.0.0-beta37 or later.\u003c/li\u003e\n\u003cli\u003eMonitor web server logs for high frequencies of 500-series status codes coinciding with process restarts.\u003c/li\u003e\n\u003cli\u003eImplement rate limiting at the WAF or reverse proxy level to mitigate the impact of the exploit while patching is pending.\u003c/li\u003e\n\u003cli\u003eEnsure that the application runtime is configured to capture and log unhandled promise rejections for visibility, although this will not prevent the process crash.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-15T22:23:31Z","date_published":"2026-10-15T22:23:31Z","id":"https://feed.craftedsignal.io/briefs/2026-10-qwik-dos/","summary":"An unauthenticated remote denial-of-service vulnerability in Qwik allows attackers to terminate Node.js server processes by sending a maliciously crafted qwik-json payload, resulting in persistent service outages.","title":"Unauthenticated Denial of Service in Qwik Framework","url":"https://feed.craftedsignal.io/briefs/2026-10-qwik-dos/"}],"language":"en","title":"CraftedSignal Threat Feed - Qwik Core (\u003c 2.0.0-Beta37)","version":"https://jsonfeed.org/version/1.1"}