Qwik patches unauthenticated RCE in server$ deserialization

TL;DR — Unsafe deserialization in Qwik's server$ RPC mechanism enables unauthenticated remote code execution with a single HTTP request.

What happened

Qwik is a modern JavaScript web framework focused on instant page loads through resumable server-side rendering. CVE-2026-27971 describes a critical unauthenticated remote code execution issue in Qwik caused by unsafe deserialization in the server$ RPC mechanism. An attacker can trigger code execution on the server with a single HTTP request, with highest risk in deployments where require() is available at runtime.

Critical CVSS 4.0 base score of 9.2. Deserialization RCE continues to be one of the most common critical vulnerability classes in JavaScript frameworks — Qwik joins Next.js, Nuxt, and Remix in having faced similar issues in their server-side RPC layers.

Who is impacted

• Projects using @builder.io/qwik versions <= 1.19.0.
• Any Qwik deployment exposing server$ RPC functionality, especially where require() is available at runtime.

What to do now

• Follow vendor remediation guidance and apply the latest patched release available at the time of writing.
• Identify production services running Qwik and inventory versions (lockfiles, container images, deployed artifacts).
• If compromise is suspected, review inbound request logs around server$ endpoints and rotate credentials accessible to the impacted service.