npm/@builder.io/qwik CVE-2026-27971: critical 9.8, EPSS 5.48%
Qwik vulnerable to Unauthenticated RCE via server$ Deserialization
Action: Upgrade @builder.io/qwik to 1.19.1 or later.
npm i @builder.io/qwik@1.19.1Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 1.19.1 | - |
Fixed versions
| 1.19.1 |
Sources
- osv: GHSA-p9x5-jp3h-96mm
- nvd: CVE-2026-27971
- https://github.com/QwikDev/qwik/security/advisories/GHSA-p9x5-jp3h-96mm
- https://github.com/QwikDev/qwik
- https://github.com/QwikDev/qwik/releases/tag/%40builder.io%2Fqwik%401.19.1
CVE-2026-27971 · published · modified · JSON