Critical severity · published Mar 3, 2026
CVE-2026-27971
Qwik affected by unauthenticated RCE via server$ Deserialization
9.8
CVSS
5.5%
EPSS
No
On KEV
Description
Qwik is a performance focused javascript framework. qwik <=1.19.0 is vulnerable to RCE due to an unsafe deserialization vulnerability in the server$ RPC mechanism that allows any unauthenticated user to execute arbitrary code on the server with a single HTTP request. Affects any deployment where require() is available at runtime. This vulnerability is fixed in 1.19.1.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)5.5% · higher than 93% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
QW
qwik · QwikDev
< 1.19.1 · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-27971
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-27971
Vendor Advisory
https://github.com/QwikDev/qwik/security/advisories/GHSA-p9x5-jp3h-96mm
More from qwik
10.0
CVE-2026-25150
Prototype Pollution via FormData Processing in Qwik City
8.7
CVE-2026-84994
Qwik: Crashing any Qwik Server via Resource thenable
7.5
CVE-2026-32701
Qwik has array method pollution in FormData processing, allowing type confusion and DoS
7.1
CVE-2026-25155
[qwik-city] CSRF protection middleware does not work properly for content type header with parameters (eg. multipart/form-data)
6.1
CVE-2026-25148
Qwik SSR XSS via Unsafe Virtual Node Serialization