Description
The unstable_redirect() helper exported from waku/router/server (packages/waku/src/router/define-router.tsx:156–161) accepts an arbitrary string and reflects it unchanged into the HTTP Location response header with no URL validation, scheme restriction, or path-only enforcement.
Recommendation
Update the waku package to the latest compatible version. Followings are version details:
- Affected version(s): <= 1.0.0-beta.0
- Patched version(s): 1.0.0-beta.1
References
Could your website be exposed too?
SmartScanner can check your website for Waku has an Open Redirect via `unstable_redirect` Helper and gives you actionable findings to investigate.
Start a free scanRelated Issues
- Nitro has an Open Redirect via Protocol-Relative URL Bypass in Wildcard Route Rules - nitro - CVE-2026-44372
- Nitro has an Open Redirect via Protocol-Relative URL Bypass in Wildcard Route Rules - CVE-2026-44372
- @workos/authkit-session has an Open Redirect via state-derived redirect target - CVE-2026-42565
- Feathers has an open redirect in OAuth callback enables account takeover - CVE-2026-27191
You might also like:
See something that needs correcting? Let us knowUpdated July 08, 2026