CVE-2026-27971 Qwik affected by unauthenticated RCE via server$ Deserialization

What is CVE-2026-27971?

CVE-2026-27971 is a critical unsafe deserialization vulnerability in QwikDev qwik, published on 3 Mar 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Qwik is a performance focused javascript framework. qwik <=1.19.0 is vulnerable to RCE due to an unsafe deserialization vulnerability in the server$ RPC mechanism that allows any unauthenticated user to execute arbitrary code on the server with a single HTTP request. Affects any deployment where require() is available at runtime. This vulnerability is fixed in 1.19.1.

Weakness: CWE-502

Which versions are affected by CVE-2026-27971?

2 open source packages ship an affected version, including @builder.io/qwik. It affects 1 product.

Products include Qwik Qwik.

How do I fix CVE-2026-27971?

Upgrade @builder.io/qwik to 1.19.1 or later.

Upgrade, and only deserialise data from trusted sources or with an allow-list of types. More about Unsafe deserialization.

Is CVE-2026-27971 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-27971 exists.

Public exploit code: 1 Nuclei template and 1 proofs of concept on GitHub.

Other vulnerabilities in QwikDev qwik

• CVE-2023-1283 Code Injection in builderio/qwik Critical 10.0
• CVE-2026-25150 Prototype Pollution via FormData Processing in Qwik City Critical 9.3
• CVE-2026-32701 Qwik has array method pollution in FormData processing, allowing type confusion and DoS High 7.5
• CVE-2024-41677 Cross-site Scripting (XSS) vulnerability due to improper HTML escaping in qwik Medium 6.3
• CVE-2023-0410 Cross-site Scripting (XSS) - Generic in builderio/qwik Medium 6.1

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-p9x5-jp3h-96mm.