Skip to content

Vendor

wakujs vulnerabilities

2 published CVES affecting wakujs, from public sources (CVE.org, NVD, CISA KEV, FIRST EPSS, OSV).

Total
2
Critical
0
High
0
Medium
1
Low
1
Unscored
0
CISA KEV
0
Atom feed of wakujs alerts

Products

Latest wakujs CVEs

Newest publication first

  1. CVE-2026-49456 Waku: Open Redirect via `unstable_redirect` Helper

    Published
    LowCVSS 3.1 EPSS 0.40%

    Waku is the minimal React framework. Prior to version 1.0.0-beta.1, the unstable_redirect() helper exported from waku/router/server (packages/waku/src/router/define-router.tsx:156–161) accepts an arbitrary string and reflects it unchanged into the HTTP Location response header wi...

  2. CVE-2026-49455 Waku: Cross-Origin CSRF on RSC Server Action Dispatch

    Published
    MediumCVSS 6.5 EPSS 0.17%

    Waku is the minimal React framework. Prior to version 1.0.0-beta.1, Waku's RSC request dispatcher invokes server actions without validating the request's Origin (or Sec-Fetch-Site) header. A cross-origin web attacker can therefore cause a victim browser to issue an authenticated...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.