Waku: Cross-Origin CSRF on RSC Server Action Dispatch

Description

Waku’s RSC request dispatcher invokes server actions without validating the request’s Origin (or Sec-Fetch-Site) header. A cross-origin web attacker can therefore cause a victim browser to issue an authenticated POST to a registered server action endpoint using a CORS-safelisted content type (text/plain), which does not trigger a preflight.

Recommendation

Update the waku package to the latest compatible version. Followings are version details:

• Affected version(s): <= 1.0.0-beta.0
• Patched version(s): 1.0.0-beta.1

References

• GHSA-75w3-gmqx-993q
• CVE-2026-49455
• CWE-352
• CAPEC-310
• OWASP 2021-A1
• OWASP 2021-A6

Related Issues

• RedwoodSDK has Same-site CSRF through lack of origin validation in its server actions - CVE-2026-42190
• Cline Kanban Server has a Cross-Origin WebSocket Hijacking Vulnerability - CVE-2026-44211
• React Router has CSRF issue in Action/Server Action Request Processing - CVE-2026-22030
• RedwoodSDK has a CSRF vulnerability in server function dispatch via GET requests - CVE-2026-39371

You might also like:

Exploiting Server Version Disclosure

CSRF, XXE, and 12 Other Security Acronyms Explained

How to Secure your NodeJs Express Javascript Application - part 1

Tags:

npm

waku