CVE-2026-27971
1 advisory.
npm/@builder.io/qwik CVE-2026-27971: critical, EPSS 2.95%
Qwik vulnerable to Unauthenticated RCE via server$ Deserialization
Action: Upgrade @builder.io/qwik to 1.19.1 or later.
npm i @builder.io/qwik@1.19.1Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 1.19.1 | - |
Fixed versions
| 1.19.1 |
Sources
- osv: GHSA-p9x5-jp3h-96mm
- https://github.com/QwikDev/qwik/security/advisories/GHSA-p9x5-jp3h-96mm
- https://nvd.nist.gov/vuln/detail/CVE-2026-27971
- https://github.com/QwikDev/qwik
- https://github.com/QwikDev/qwik/releases/tag/%40builder.io%2Fqwik%401.19.1
CVE-2026-27971 · published · modified · JSON