{"action":"Upgrade @builder.io/qwik to 1.20.0 or later.","affected":[{"fixed":"1.20.0","introduced":"0"}],"component":"@builder.io/qwik","cve_ids":["CVE-2026-84994"],"ecosystem":"npm","exploited":false,"fixed_versions":["1.20.0"],"ghsa_id":"GHSA-x586-xvc8-g7q6","id":"tcs_01M5JHG11QZWPYWFWEQXSFE61Y","modified_at":"2026-10-15T20:30:03.950741495Z","published_at":"2026-10-15T20:22:00Z","references":["https://osv.dev/vulnerability/GHSA-x586-xvc8-g7q6","https://github.com/QwikDev/qwik/security/advisories/GHSA-x586-xvc8-g7q6","https://nvd.nist.gov/vuln/detail/CVE-2026-84994","https://github.com/QwikDev/qwik/pull/8655","https://github.com/QwikDev/qwik/commit/c1e7444402f9592b5cf9096e10bf303ab4640511","https://github.com/QwikDev/qwik","https://github.com/QwikDev/qwik/releases/tag/@builder.io/qwik@1.20.0"],"severity":{"label":"high","score":8.7},"sources":[{"source":"osv","source_id":"GHSA-x586-xvc8-g7q6","url":"https://osv.dev/vulnerability/GHSA-x586-xvc8-g7q6"},{"source":"nvd","source_id":"CVE-2026-84994","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-84994"}],"summary":"Qwik: Crashing any Qwik Server via Resource thenable"}