Qwik: Crashing any Qwik Server via Resource thenable

Summary

A Qwik server in the default configuration can be crashed with one unauthenticated HTTP request. During qwik-json body parsing, ResourceSerializer.$fill$ does Promise.resolve(resource._resolved). If _resolved is a plain object whose .then is a QRL for an unregistered symbol, the async QRL rejects, the rejection is orphaned, and Node terminates the process via its default unhandled-rejection policy.

Impact

One unauthenticated request crashes the server. Looping keeps every replica dead as long as the attacker sends requests.