Résumé
Qwik: Crashing any Qwik Server via Resource thenable
Détails de l’avis
Summary
A Qwik server in the default configuration can be crashed with one unauthenticated HTTP request. During qwik-json body parsing, ResourceSerializer.$fill$ does Promise.resolve(resource._resolved). If _resolved is a plain object whose .then is a QRL for an unregistered symbol, the async QRL rejects, the rejection is orphaned, and Node terminates the process via its default unhandled-rejection policy.
Impact
One unauthenticated request crashes the server. Looping keeps every replica dead as long as the attacker sends requests.
Références
- https://github.com/advisories/GHSA-x586-xvc8-g7q6
- https://github.com/QwikDev/qwik/security/advisories/GHSA-x586-xvc8-g7q6
- https://nvd.nist.gov/vuln/detail/CVE-2026-84994
- https://github.com/QwikDev/qwik/pull/8655
- https://github.com/QwikDev/qwik/commit/c1e7444402f9592b5cf9096e10bf303ab4640511
- https://github.com/QwikDev/qwik/releases/tag/@builder.io/qwik@1.20.0
Vulnérabilités liées
Tout Supply chain →- MEDIUMCVE-2026-100347
kin-openapi: Unauthenticated panic (DoS) in openapi3filter legacy router via non-canonical/unsupported HTTP method on a static path
- HIGHCVE-2026-97394
kin-openapi: Nil-pointer dereference panic in openapi3filter for OpenAPI 3.1 array schemas missing items
- MEDIUMCVE-2026-107382
MariaDB Connector/Node.js: Uncaught exception crashes the client during ed25519 authentication with zero-configuration TLS
- MEDIUMCVE-2026-107392
music-metadata: uncatchable process crash parsing a crafted `.dsf` (residual of GHSA-v6c2-xwv6-8xf7)
- HIGHCVE-2026-107214
Excelize Decrypt: unrecoverable panics on malformed OLE/CFB encrypted workbooks
- MEDIUMCVE-2026-106122
RabbitMQ: Malformed UTF-8 in shortstr properties permanently disables RPC consumers