Qwik’s default server-side JSON deserialization contains a flaw where resource._resolved is passed to Promise.resolve even when it is an attacker‑controlled thenable. When that thenable is a QRL for an unregistered symbol, an orphaned asynchronous rejection is created. Under Node.js’s default unhandled‑rejection policy, this rejection terminates the process. The result is a single crafted request that crashes the entire Qwik server, and repeated requests can keep a cluster of replicas unavailable. The weakness is a type‑of‑intended‑identity error (CWE‑248).

This issue affects all Qwik installations running @builder.io/qwik versions earlier than 1.20.0 and @qwik.dev/core earlier than 2.0.0‑beta.37. Versions 1.20.0 and later, and 2.0.0‑beta.37 and later, contain the patch that prevents the untrusted thenable from being passed to Promise.resolve.

With a CVSS score of 8.7, the flaw is considered high severity. No EPSS data is available, but the vulnerability can be triggered with an unauthenticated HTTP request, indicating that exploitation is feasible even without privileged access. The vulnerability is not listed in CISA’s KEV catalog, yet the simplicity of the attack vector suggests that an attacker could repeatedly crash a service by sending a single crafted JSON payload.