CVE-2026-84994 Builder.io CVE debrief

Who should care

Defenders responsible for Qwik server configurations, administrators of Qwik-based applications, and security teams should assess exposure and prioritize updates to prevent server crashes. This includes operators managing Qwik servers, platform administrators, and vulnerability management teams who need to verify configurations and apply updates to prevent potential denial-of-service attacks.

Why it matters

CVE-2026-84994 is a high-severity vulnerability in Qwik servers that can be exploited with a single unauthenticated HTTP request, potentially leading to server crashes and denial of service.

• Potential for server crashes leading to denial of service
• Need for verification of Qwik server configurations
• Requirement for updates to version 1.20.0 or later
• Importance of monitoring server logs for potential attacks

Technical summary

A Qwik server in the default configuration can be crashed with one unauthenticated HTTP request. During qwik-json body parsing, `ResourceSerializer.$fill$` does `Promise.resolve(resource._resolved)`. If `_resolved` is a plain object whose `.then` is a QRL for an unregistered symbol, the async QRL rejects, the rejection is orphaned, and Node terminates the process via its default unhandled-rejection policy.

Defensive priority

Defenders should prioritize verifying Qwik server configurations and updating to version 1.20.0 or later to prevent server crashes.

Recommended defensive actions

• Verify Qwik server configurations to prevent server crashes
• Update to version 1.20.0 or later
• Monitor server logs for potential attacks
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The source corpus provides details on the vulnerability, including a summary of the issue and its impact. However, the corpus does not provide information on exploitation or affected versions beyond the fixed version of 1.20.0.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.