Skip to content
OpenAdvisories

Package · npm

waku

2 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Feed

  • Low 3.1
    CVE-2026-49456

    Waku: Open Redirect via `unstable_redirect` Helper

    Waku is the minimal React framework. Prior to version 1.0.0-beta.1, the unstable_redirect() helper exported from waku/router/server (packages/waku/src/router/define-router.tsx:156–161) accepts an arbitrary string and reflects it unchanged into the HTTP Locati…

    wakujs waku waku npm
  • Medium 6.5
    CVE-2026-49455

    Waku: Cross-Origin CSRF on RSC Server Action Dispatch

    Waku is the minimal React framework. Prior to version 1.0.0-beta.1, Waku's RSC request dispatcher invokes server actions without validating the request's Origin (or Sec-Fetch-Site) header. A cross-origin web attacker can therefore cause a victim browser to is…

    wakujs waku waku npm