RedwoodSDK has a CSRF vulnerability in server function dispatch via GET requests

Description

Summary

Server functions exported from "use server" files could be invoked via GET requests, bypassing their intended HTTP method. In cookie-authenticated applications, this allowed cross-site GET navigations to trigger state-changing functions, because browsers send SameSite=Lax cookies on top-level GET requests.

Recommendation

Update the rwsdk package to the latest compatible version. Followings are version details:

• Affected version(s): >= 1.0.0-beta.50, <= 1.0.5
• Patched version(s): 1.0.6

References

• GHSA-x8rx-789c-2pxq
• CVE-2026-39371
• CWE-352
• CAPEC-310
• OWASP 2021-A1
• OWASP 2021-A6

Related Issues

• RedwoodSDK has Same-site CSRF through lack of origin validation in its server actions - CVE-2026-42190
• @better-auth/sso provider registration has server-side request forgery via unvalidated OIDC endpoints - CVE-2026-53513
• Qwik City has a CSRF Protection Bypass via Content-Type Header Validation - CVE-2026-25151
• React Router: Potential CSRF via PUT/PATCH/DELETE document requests - CVE-2026-53663

You might also like:

CSRF, XXE, and 12 Other Security Acronyms Explained

Exploiting Server Version Disclosure

How to Secure your NodeJs Express Javascript Application - part 1

Tags:

npm

rwsdk