Qwik vulnerable to Unauthenticated RCE via server$ Deserialization

CRITICAL 9.8CVE-2026-27971 · GHSA-p9x5-jp3h-96mm · Published 03/03/2026 · updated 17/06/2026

Package	Affected versions	Patched versions
qwik qwik	`< 1.19.1`	`1.19.1`
@builder.io/qwik npm	`< 1.19.1`	`1.19.1`

Description

Summary

qwik <=1.19.0 is vulnerable to RCE due to an unsafe deserialization vulnerability in the server$ RPC mechanism that allows any unauthenticated user to execute arbitrary code on the server with a single HTTP request. Affects any deployment where require() is available at runtime.

Impact

Remote Code Execution

NVD description

Qwik is a performance focused javascript framework. qwik <=1.19.0 is vulnerable to RCE due to an unsafe deserialization vulnerability in the server$ RPC mechanism that allows any unauthenticated user to execute arbitrary code on the server with a single HTTP request. Affects any deployment where require() is available at runtime. This vulnerability is fixed in 1.19.1.

References

QwikDev/qwik security advisory · WEB
nvd.nist.gov/vuln/detail/CVE-2026-27971 · ADVISORY
QwikDev/qwik · PACKAGE
QwikDev/qwik release @builder.io/[email protected] · WEB

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free