Listen to this Post
The vulnerability resides within the default server-side qwik-json body parsing implementation of the Qwik framework. During the processing workflow, the `ResourceSerializer.$fill$` method handles resource resolution by passing `resource._resolved` directly into `Promise.resolve()` without validating whether the input is a safe value or an attacker-controlled thenable object. An unauthenticated remote attacker can exploit this behavior by crafting a malicious HTTP request containing a plain object where the `then` property is structured as a QRL pointing to an unregistered symbol. When Qwik attempts to evaluate this structure, the asynchronous operation fails and generates a rejection, which subsequently becomes orphaned because proper error handling or catch blocks are absent in this specific resolution flow. Under the default runtime behavior of Node.js, an unhandled promise rejection of this nature is treated as a fatal exception, forcing the runtime environment to immediately terminate the entire process. Because the endpoint requires no prior authentication or user interaction, a single carefully constructed HTTP payload is sufficient to crash the server process entirely. Furthermore, if an automated script or attacker continuously streams these malicious requests toward the target application, any underlying container orchestration layer or replica set will experience continuous crashes, keeping the service completely unavailable and resulting in a severe denial of service condition across the entire infrastructure deployment.
DailyCVE Form:
Platform: Qwik
Version: <1.20.0
Vulnerability : DoS
Severity: High
date: 2026-09-22
Prediction: 2026-09-22
What Undercode Say:
Analytics
The root cause stems from unsafe assumption patterns during deserialization where custom thenables are passed blindly into native promise resolution handlers, bypassing necessary type checks and triggering fatal runtime behavior under unhandled exception conditions.
Exploit: (Educational Purposes!)
curl -X POST "http://target-server/" \
-H "Content-Type: application/json" \
-d '{"qwik-json": {"r": {"_resolved": {"then": {"$qrl": "unregistered-symbol"}}}}}'
Protection:
Upgrade the `@builder.io/qwik` package to version 1.20.0 or later, and `@qwik.dev/core` to version 2.0.0-beta.37 or later, where resource thenables are properly validated and handled before promise resolution.
Impact:
Allows any remote unauthenticated attacker to cause a complete denial of service via process termination of the Node.js server using a single crafted HTTP request, with continuous looping keeping all application replicas offline.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
