Waku has an Open Redirect via `unstable_redirect` Helper

Description

The unstable_redirect() helper exported from waku/router/server (packages/waku/src/router/define-router.tsx:156–161) accepts an arbitrary string and reflects it unchanged into the HTTP Location response header with no URL validation, scheme restriction, or path-only enforcement.

Recommendation

Update the waku package to the latest compatible version. Followings are version details:

• Affected version(s): <= 1.0.0-beta.0
• Patched version(s): 1.0.0-beta.1

References

• GHSA-43fc-v873-qw85
• CVE-2026-49456
• CWE-601
• CAPEC-310
• OWASP 2021-A1
• OWASP 2021-A6

Related Issues

• Nitro has an Open Redirect via Protocol-Relative URL Bypass in Wildcard Route Rules - nitro - CVE-2026-44372
• Nitro has an Open Redirect via Protocol-Relative URL Bypass in Wildcard Route Rules - CVE-2026-44372
• @workos/authkit-session has an Open Redirect via state-derived redirect target - CVE-2026-42565
• Feathers has an open redirect in OAuth callback enables account takeover - CVE-2026-27191

You might also like:

How to Secure your NodeJs Express Javascript Application - part 1

How to Secure your NodeJs Express Javascript Application - part 2

10 Secure Coding Best Practices to Follow in Every Project

Tags:

npm

waku