Description
Waku’s RSC request dispatcher invokes server actions without validating the request’s Origin (or Sec-Fetch-Site) header. A cross-origin web attacker can therefore cause a victim browser to issue an authenticated POST to a registered server action endpoint using a CORS-safelisted content type (text/plain), which does not trigger a preflight.
Recommendation
Update the waku package to the latest compatible version. Followings are version details:
- Affected version(s): <= 1.0.0-beta.0
- Patched version(s): 1.0.0-beta.1
References
Could your website be exposed too?
SmartScanner can check your website for Waku: Cross-Origin CSRF on RSC Server Action Dispatch and gives you actionable findings to investigate.
Start a free scanRelated Issues
- RedwoodSDK has Same-site CSRF through lack of origin validation in its server actions - CVE-2026-42190
- Cline Kanban Server has a Cross-Origin WebSocket Hijacking Vulnerability - CVE-2026-44211
- React Router has CSRF issue in Action/Server Action Request Processing - CVE-2026-22030
- RedwoodSDK has a CSRF vulnerability in server function dispatch via GET requests - CVE-2026-39371
You might also like:
See something that needs correcting? Let us knowUpdated July 08, 2026