{"action":"Upgrade @qwik.dev/core to 2.0.0-beta37 or later.","affected":[{"fixed":"2.0.0-beta37","introduced":"0"}],"component":"@qwik.dev/core","cve_ids":["CVE-2026-84994"],"ecosystem":"npm","epss":0.00524,"exploited":false,"fixed_versions":["2.0.0-beta37"],"ghsa_id":"GHSA-x586-xvc8-g7q6","id":"tcs_01M5KGH04DNXNFRAFD46H1J6EP","modified_at":"2026-10-15T20:30:03.950741495Z","published_at":"2026-10-15T20:22:00Z","references":["https://osv.dev/vulnerability/GHSA-x586-xvc8-g7q6","https://github.com/QwikDev/qwik/security/advisories/GHSA-x586-xvc8-g7q6","https://nvd.nist.gov/vuln/detail/CVE-2026-84994","https://github.com/QwikDev/qwik/pull/8655","https://github.com/QwikDev/qwik/commit/c1e7444402f9592b5cf9096e10bf303ab4640511","https://github.com/QwikDev/qwik","https://github.com/QwikDev/qwik/releases/tag/@builder.io/qwik@1.20.0"],"severity":{"label":"high"},"sources":[{"source":"osv","source_id":"GHSA-x586-xvc8-g7q6#npm/@qwik.dev/core","url":"https://osv.dev/vulnerability/GHSA-x586-xvc8-g7q6"}],"summary":"Qwik: Crashing any Qwik Server via Resource thenable"}