TI-2026-36610 Aliases CVE-2026-49455 GHSA-75w3-gmqx-993q

Waku: Cross-Origin CSRF on RSC Server Action Dispatch

LOW 28CWE-352Published 2026-09-03 · Updated 2026-09-03

Key facts

Attack vector: Network
Privileges required: None
User interaction: Required
Attack complexity: Low
Impact type: Tampering
Confidentiality · integrity · availability: None · High · None
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-352.

Summary

Waku is the minimal React framework. Prior to version 1.0.0-beta.1, Waku's RSC request dispatcher invokes server actions without validating the request's Origin (or Sec-Fetch-Site) header. A cross-origin web attacker can therefore cause a victim browser to issue an authenticated POST to a registered server action endpoint using a CORS-safelisted content type (text/plain), which does not trigger a preflight. Any state-mutating server action that the application exposes via 'use server' can be invoked with the victim's cookies attached. This issue has been patched in version 1.0.0-beta.1.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00174 6th percentileScored 2026-11-07

Fix Fixed waku (wakujs): 1.0.0-beta.1waku (npm): 1.0.0-beta.1

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
wakujs	waku	before 1.0.0-beta.1	1.0.0-beta.1	Patch available	CNA
—	waku (npm)	before 1.0.0-beta.1	1.0.0-beta.1	Patch available	GHSA-75w3-gmqx-993q

waku Vendorwakujs Affected before 1.0.0-beta.1 Fixed in 1.0.0-beta.1 Patch available CNA
waku (npm) Vendor— Affected before 1.0.0-beta.1 Fixed in 1.0.0-beta.1 Patch available GHSA-75w3-gmqx-993q

Remediation

Fix · CNA waku (wakujs) Fixed in 1.0.0-beta.1
Fix · GHSA-75w3-gmqx-993q waku (npm) Fixed in 1.0.0-beta.1 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2026-49455
2026-10-03 Alias added: GHSA-75w3-gmqx-993q

References

Other 3

TI-2026-36611 Waku: Open Redirect via `unstable_redirect` Helper CVSS 3.1LOW 3.1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences