Threats tagged 'ghsa-x586-xvc8-g7q6'

CVE-2026-84994 is a high-severity vulnerability in the Qwik JavaScript framework prior to versions 1.20.0 and 2.0.0-beta.37. It involves uncaught exceptions caused by improper handling of thenables during server-side JSON deserialization. An unauthenticated attacker can send specially crafted requests that cause the Node.js server to terminate due to unhandled promise rejections, resulting in denial of service. This can crash a single server or keep multiple replicas unavailable. The issue is fixed in the specified versions.