CVE-2026-27971criticalobserved exploitationCWE-502

CVE-2026-27971: critical vulnerability in QwikDev qwik

Qwik affected by unauthenticated RCE via server$ Deserialization

Published · Updated

Follow this CVE+ Monitor qwik+ Monitor @builder.io/qwik

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

85Vexday Risk Score

Patch now. It exploitation observed by VulnCheck and has a working public exploit.

ssvc Actcvss 9.2epss 5.5%
from disclosure to weapon140 days
Published on NVDMar 3
1st PoC+140d
VulnCheck+29d
Qwik is a performance focused javascript framework. qwik <=1.19.0 is vulnerable to RCE due to an unsafe deserialization vulnerability in the server$ RPC mechanism that allows any unauthenticated user to execute arbitrary code on the server with a single HTTP request. Affects any deployment where require() is available at runtime. This vulnerability is fixed in 1.19.1.
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Affected products
QwikDev · qwik
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — QwikDev qwik

In the same product, most dangerous first.

CVE-2026-25150CRITICALPrototype Pollution via FormData Processing in Qwik CityEPSS 0.7%CVE-2026-84994HIGHQwik: Crashing any Qwik Server via Resource thenableEPSS 0.5%CVE-2024-41677MEDIUMCross-site Scripting (XSS) vulnerability due to improper HTML escaping in qwikEPSS 0.5%CVE-2026-32701HIGHQwik has array method pollution in FormData processing, allowing type confusion and DoSEPSS 0.5%CVE-2025-53620CRITICALCrashing any Qwik ServerEPSS 0.4%CVE-2026-25148MEDIUMQwik SSR XSS via Unsafe Virtual Node SerializationEPSS 0.3%