Vulnerability-Lookup

CVE-2026-49455 (GCVE-0-2026-49455)

Vulnerability from cvelistv5 – Published: 2026-09-03 18:15 – Updated: 2026-09-03 18:34

Title

Waku: Cross-Origin CSRF on RSC Server Action Dispatch

Summary

Waku is the minimal React framework. Prior to version 1.0.0-beta.1, Waku's RSC request dispatcher invokes server actions without validating the request's Origin (or Sec-Fetch-Site) header. A cross-origin web attacker can therefore cause a victim browser to issue an authenticated POST to a registered server action endpoint using a CORS-safelisted content type (text/plain), which does not trigger a preflight. Any state-mutating server action that the application exposes via 'use server' can be invoked with the victim's cookies attached. This issue has been patched in version 1.0.0-beta.1.

Severity

6.5 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-03 18:32 UTC

CWE

CWE-352 - Cross-Site Request Forgery (CSRF)

Assigner

GitHub_M mitre root

References

2 references

URL	Tags
https://github.com/wakujs/waku/security/advisorie…	x_refsource_CONFIRM
https://github.com/wakujs/waku/releases/tag/v1.0.…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version	CPE status
wakujs	waku	Affected: < 1.0.0-beta.1	guessed

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-49455",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-03T18:32:58.949158Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-03T18:34:19.918Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "waku",
          "vendor": "wakujs",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 1.0.0-beta.1"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Waku is the minimal React framework. Prior to version 1.0.0-beta.1, Waku\u0027s RSC request dispatcher invokes server actions without validating the request\u0027s Origin (or Sec-Fetch-Site) header. A cross-origin web attacker can therefore cause a victim browser to issue an authenticated POST to a registered server action endpoint using a CORS-safelisted content type (text/plain), which does not trigger a preflight. Any state-mutating server action that the application exposes via \u0027use server\u0027 can be invoked with the victim\u0027s cookies attached. This issue has been patched in version 1.0.0-beta.1."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-352",
              "description": "CWE-352: Cross-Site Request Forgery (CSRF)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-03T18:15:42.014Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/wakujs/waku/security/advisories/GHSA-75w3-gmqx-993q",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/wakujs/waku/security/advisories/GHSA-75w3-gmqx-993q"
        },
        {
          "name": "https://github.com/wakujs/waku/releases/tag/v1.0.0-beta.1",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/wakujs/waku/releases/tag/v1.0.0-beta.1"
        }
      ],
      "source": {
        "advisory": "GHSA-75w3-gmqx-993q",
        "discovery": "UNKNOWN"
      },
      "title": "Waku: Cross-Origin CSRF on RSC Server Action Dispatch"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-49455",
    "datePublished": "2026-09-03T18:15:42.014Z",
    "dateReserved": "2026-05-30T02:43:33.107Z",
    "dateUpdated": "2026-09-03T18:34:19.918Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-49455",
      "date": "2026-09-18",
      "epss": "0.00119",
      "percentile": "0.02042"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "product": "waku",
                "vendor": "wakujs",
                "versions": [
                  {
                    "status": "affected",
                    "version": "\u003c 1.0.0-beta.1"
                  }
                ]
              }
            ],
            "source": "security-advisories@github.com"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "Waku is the minimal React framework. Prior to version 1.0.0-beta.1, Waku\u0027s RSC request dispatcher invokes server actions without validating the request\u0027s Origin (or Sec-Fetch-Site) header. A cross-origin web attacker can therefore cause a victim browser to issue an authenticated POST to a registered server action endpoint using a CORS-safelisted content type (text/plain), which does not trigger a preflight. Any state-mutating server action that the application exposes via \u0027use server\u0027 can be invoked with the victim\u0027s cookies attached. This issue has been patched in version 1.0.0-beta.1."
          }
        ],
        "id": "CVE-2026-49455",
        "lastModified": "2026-09-09T20:20:21.673",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "NONE",
                "baseScore": 6.5,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "NONE",
                "integrityImpact": "HIGH",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "REQUIRED",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N",
                "version": "3.1"
              },
              "exploitabilityScore": 2.8,
              "impactScore": 3.6,
              "source": "security-advisories@github.com",
              "type": "Secondary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2026-49455",
                "options": [
                  {
                    "exploitation": "none"
                  },
                  {
                    "automatable": "no"
                  },
                  {
                    "technicalImpact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-03T18:32:58.949158Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2026-09-03T19:17:28.100",
        "references": [
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/wakujs/waku/releases/tag/v1.0.0-beta.1"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/wakujs/waku/security/advisories/GHSA-75w3-gmqx-993q"
          }
        ],
        "sourceIdentifier": "security-advisories@github.com",
        "vulnStatus": "Deferred",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-352"
              }
            ],
            "source": "security-advisories@github.com",
            "type": "Primary"
          }
        ]
      }
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2026-49455",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "partial"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2026-09-03T18:32:58.949158Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2026-09-03T18:34:07.524Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "product": "waku",
              "vendor": "wakujs",
              "versions": [
                {
                  "status": "affected",
                  "version": "\u003c 1.0.0-beta.1"
                }
              ]
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "Waku is the minimal React framework. Prior to version 1.0.0-beta.1, Waku\u0027s RSC request dispatcher invokes server actions without validating the request\u0027s Origin (or Sec-Fetch-Site) header. A cross-origin web attacker can therefore cause a victim browser to issue an authenticated POST to a registered server action endpoint using a CORS-safelisted content type (text/plain), which does not trigger a preflight. Any state-mutating server action that the application exposes via \u0027use server\u0027 can be invoked with the victim\u0027s cookies attached. This issue has been patched in version 1.0.0-beta.1."
            }
          ],
          "metrics": [
            {
              "cvssV3_1": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "NONE",
                "baseScore": 6.5,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "NONE",
                "integrityImpact": "HIGH",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "REQUIRED",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N",
                "version": "3.1"
              }
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-352",
                  "description": "CWE-352: Cross-Site Request Forgery (CSRF)",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-09-03T18:15:42.014Z",
            "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
            "shortName": "GitHub_M"
          },
          "references": [
            {
              "name": "https://github.com/wakujs/waku/security/advisories/GHSA-75w3-gmqx-993q",
              "tags": [
                "x_refsource_CONFIRM"
              ],
              "url": "https://github.com/wakujs/waku/security/advisories/GHSA-75w3-gmqx-993q"
            },
            {
              "name": "https://github.com/wakujs/waku/releases/tag/v1.0.0-beta.1",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/wakujs/waku/releases/tag/v1.0.0-beta.1"
            }
          ],
          "source": {
            "advisory": "GHSA-75w3-gmqx-993q",
            "discovery": "UNKNOWN"
          },
          "title": "Waku: Cross-Origin CSRF on RSC Server Action Dispatch"
        }
      },
      "cveMetadata": {
        "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "assignerShortName": "GitHub_M",
        "cveId": "CVE-2026-49455",
        "datePublished": "2026-09-03T18:15:42.014Z",
        "dateReserved": "2026-05-30T02:43:33.107Z",
        "dateUpdated": "2026-09-03T18:34:19.918Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

FKIE_CVE-2026-49455

Vulnerability from fkie_nvd - Published: 2026-09-03 19:17 - Updated: 2026-09-09 20:20

Severity

6.5 (Medium) - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

Summary

References

	URL	Tags
	security-advisories@github.com	https://github.com/wakujs/waku/releases/tag/v1.0.0-beta.1
	security-advisories@github.com	https://github.com/wakujs/waku/security/advisories/GHSA-75w3-gmqx-993q

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "waku",
          "vendor": "wakujs",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 1.0.0-beta.1"
            }
          ]
        }
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Waku is the minimal React framework. Prior to version 1.0.0-beta.1, Waku\u0027s RSC request dispatcher invokes server actions without validating the request\u0027s Origin (or Sec-Fetch-Site) header. A cross-origin web attacker can therefore cause a victim browser to issue an authenticated POST to a registered server action endpoint using a CORS-safelisted content type (text/plain), which does not trigger a preflight. Any state-mutating server action that the application exposes via \u0027use server\u0027 can be invoked with the victim\u0027s cookies attached. This issue has been patched in version 1.0.0-beta.1."
    }
  ],
  "id": "CVE-2026-49455",
  "lastModified": "2026-09-09T20:20:21.673",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 6.5,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "NONE",
          "integrityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "REQUIRED",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 3.6,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-49455",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-09-03T18:32:58.949158Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-09-03T19:17:28.100",
  "references": [
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/wakujs/waku/releases/tag/v1.0.0-beta.1"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/wakujs/waku/security/advisories/GHSA-75w3-gmqx-993q"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-352"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Primary"
    }
  ]
}

GHSA-75W3-GMQX-993Q

Vulnerability from github – Published: 2026-07-08 20:27 – Updated: 2026-07-08 20:27

Summary

Waku: Cross-Origin CSRF on RSC Server Action Dispatch

Details

Summary

Waku's RSC request dispatcher invokes server actions without validating the request's Origin (or Sec-Fetch-Site) header. A cross-origin web attacker can therefore cause a victim browser to issue an authenticated POST to a registered server action endpoint using a CORS-safelisted content type (text/plain), which does not trigger a preflight. Any state-mutating server action that the application exposes via 'use server' can be invoked with the victim's cookies attached. A working proof-of-concept demonstrates the vulnerability against waku 1.0.0-beta.0 dev server: a cross-origin POST with Content-Type: text/plain invokes a registered 'use server' action and returns HTTP 200 with an RSC stream response. The same defect affects the progressive-enhancement (no-JavaScript) server action path: a cross-origin HTML form auto-submitting multipart/form-data reaches the dispatch through a second unguarded branch of the request handler, dynamically confirmed on 2026-05-17. Both branches were confirmed exploitable from opaque-origin contexts (sandboxed iframes, file:// navigation, browser extension pages), which send Origin: null — a value no Origin guard exists to reject. This is the same vulnerability class previously disclosed for Next.js Server Actions (GHSA-mq59-m269-xvcx); waku's implementation is broader in that no Origin check exists at all in the default request handler.

Root cause

In packages/waku/src/lib/utils/request.ts:

// line 29
if (pathname.startsWith(rscPathPrefix)) {
  rscPath = decodeRscPath(pathname.slice(rscPathPrefix.length));
  const actionId = decodeFuncId(rscPath);
  if (actionId) {
    const body = await getActionBody(req);
    const args = await decodeReply(body, { temporaryReferences });
    const action = await loadServerAction(actionId);
    // ...action is invoked with attacker-supplied args
  }
}

The sibling else if (req.method === 'POST') branch (line 61) does enforce a method check, but only for non-RSC paths. The RSC dispatch branch has no equivalent guard. For comparison, frameworks in the same category (Next.js, Remix) compare the request's Origin header against the configured host before invoking a server action.

Trigger (one-line summary)

A cross-origin POST with Content-Type: text/plain to /<rscBase>/<encoded-action-path> reaches loadServerAction and invokes a registered 'use server' action with the victim's browser-attached cookies.

Affected entry surfaces

All HTTP adapters exposed by waku (packages/waku/src/adapters/node.ts, cloudflare.ts, vercel.ts, edge.ts) — each chains through the same request.ts:getInput dispatcher.
Any server action declared with 'use server' and reachable from the Vite module graph (i.e., normal application code).

Suggested fix outline

Add an Origin (and ideally Sec-Fetch-Site) validation step in the RSC dispatch branch of getInput, gated against the configured base URL host, with an opt-in allowedOrigins configuration option for legitimate cross-origin scenarios. Exact patch sketches will be provided in the follow-up comment.

Disclosure

Field	Value
Reporter	j0hndo (dohyun4466@gmail.com)
Discovery date	2026-05-15
Embargo	90 days from acknowledgement (operator open to extension on request)
Comparable precedent	Next.js GHSA-mq59-m269-xvcx ("null origin can bypass Server Actions CSRF checks"), CVSS 5.3, fixed Next.js 16.1.7
References	OWASP CSRF cheat sheet; Fetch spec § CORS-safelisted request-header (text/plain).

Workarounds (publish-safe)

Until a framework-level fix is released, operators can mitigate by placing an Origin-validating reverse proxy or middleware in front of waku that rejects requests whose Origin header does not match the application's host on POST requests to the configured rscBase prefix. Note that Vite's server.allowedHosts guard (which rejects unrecognized Host headers with HTTP 403) applies only to waku dev; production deployments using waku build && waku start do not have an equivalent guard and are fully exposed without an external mitigation layer.

Severity

6.5 (Medium)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 1.0.0-beta.0"
      },
      "package": {
        "ecosystem": "npm",
        "name": "waku"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.0.0-beta.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-49455"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-352"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-07-08T20:27:11Z",
    "nvd_published_at": null,
    "severity": "MODERATE"
  },
  "details": "## Summary\n\nWaku\u0027s RSC request dispatcher invokes server actions without validating the request\u0027s `Origin` (or `Sec-Fetch-Site`) header. A cross-origin web attacker can therefore cause a victim browser to issue an authenticated `POST` to a registered server action endpoint using a CORS-safelisted content type (`text/plain`), which does not trigger a preflight. Any state-mutating server action that the application exposes via `\u0027use server\u0027` can be invoked with the victim\u0027s cookies attached. A working proof-of-concept demonstrates the vulnerability against waku 1.0.0-beta.0 dev server: a cross-origin POST with `Content-Type: text/plain` invokes a registered `\u0027use server\u0027` action and returns HTTP 200 with an RSC stream response. The same defect affects the progressive-enhancement (no-JavaScript) server action path: a cross-origin HTML form auto-submitting `multipart/form-data` reaches the dispatch through a second unguarded branch of the request handler, dynamically confirmed on 2026-05-17. Both branches were confirmed exploitable from opaque-origin contexts (sandboxed iframes, `file://` navigation, browser extension pages), which send `Origin: null` \u2014 a value no Origin guard exists to reject. This is the same vulnerability class previously disclosed for Next.js Server Actions (GHSA-mq59-m269-xvcx); waku\u0027s implementation is broader in that no Origin check exists at all in the default request handler.\n\n\n## Root cause\n\nIn `packages/waku/src/lib/utils/request.ts`:\n\n```ts\n// line 29\nif (pathname.startsWith(rscPathPrefix)) {\n  rscPath = decodeRscPath(pathname.slice(rscPathPrefix.length));\n  const actionId = decodeFuncId(rscPath);\n  if (actionId) {\n    const body = await getActionBody(req);\n    const args = await decodeReply(body, { temporaryReferences });\n    const action = await loadServerAction(actionId);\n    // ...action is invoked with attacker-supplied args\n  }\n}\n```\n\nThe sibling `else if (req.method === \u0027POST\u0027)` branch (line 61) does enforce a method check, but only for non-RSC paths. The RSC dispatch branch has no equivalent guard. For comparison, frameworks in the same category (Next.js, Remix) compare the request\u0027s `Origin` header against the configured host before invoking a server action.\n\n## Trigger (one-line summary)\n\nA cross-origin `POST` with `Content-Type: text/plain` to `/\u003crscBase\u003e/\u003cencoded-action-path\u003e` reaches `loadServerAction` and invokes a registered `\u0027use server\u0027` action with the victim\u0027s browser-attached cookies.\n\n## Affected entry surfaces\n\n- All HTTP adapters exposed by waku (`packages/waku/src/adapters/node.ts`, `cloudflare.ts`, `vercel.ts`, `edge.ts`) \u2014 each chains through the same `request.ts:getInput` dispatcher.\n- Any server action declared with `\u0027use server\u0027` and reachable from the Vite module graph (i.e., normal application code).\n\n## Suggested fix outline\n\nAdd an `Origin` (and ideally `Sec-Fetch-Site`) validation step in the RSC dispatch branch of `getInput`, gated against the configured base URL host, with an opt-in `allowedOrigins` configuration option for legitimate cross-origin scenarios. Exact patch sketches will be provided in the follow-up comment.\n\n## Disclosure\n\n| Field | Value |\n|---|---|\n| Reporter | j0hndo (dohyun4466@gmail.com) |\n| Discovery date | 2026-05-15 |\n| Embargo | 90 days from acknowledgement (operator open to extension on request) |\n| Comparable precedent | Next.js GHSA-mq59-m269-xvcx (\"null origin can bypass Server Actions CSRF checks\"), CVSS 5.3, fixed Next.js 16.1.7 |\n| References | OWASP CSRF cheat sheet; Fetch spec \u00a7 CORS-safelisted request-header (text/plain). |\n\n## Workarounds (publish-safe)\n\nUntil a framework-level fix is released, operators can mitigate by placing an `Origin`-validating reverse proxy or middleware in front of waku that rejects requests whose `Origin` header does not match the application\u0027s host on `POST` requests to the configured `rscBase` prefix. Note that Vite\u0027s `server.allowedHosts` guard (which rejects unrecognized `Host` headers with HTTP 403) applies only to `waku dev`; production deployments using `waku build \u0026\u0026 waku start` do not have an equivalent guard and are fully exposed without an external mitigation layer.",
  "id": "GHSA-75w3-gmqx-993q",
  "modified": "2026-07-08T20:27:11Z",
  "published": "2026-07-08T20:27:11Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/wakujs/waku/security/advisories/GHSA-75w3-gmqx-993q"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/wakujs/waku"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Waku: Cross-Origin CSRF on RSC Server Action Dispatch"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2026-49455 (GCVE-0-2026-49455)

FKIE_CVE-2026-49455

GHSA-75W3-GMQX-993Q

Summary

Root cause

Trigger (one-line summary)

Affected entry surfaces

Suggested fix outline

Disclosure

Workarounds (publish-safe)

Tags

Sightings

Nomenclature

Related by attack behaviour