Skip to content
OpenAdvisories

Vendor

wakujs

2 known vulnerabilities.

Products

waku 2
All Critical High Medium Low Exploited only Public exploit

1 result · Clear filters · Feed

  • Medium 6.5
    CVE-2026-49455

    Waku: Cross-Origin CSRF on RSC Server Action Dispatch

    Waku is the minimal React framework. Prior to version 1.0.0-beta.1, Waku's RSC request dispatcher invokes server actions without validating the request's Origin (or Sec-Fetch-Site) header. A cross-origin web attacker can therefore cause a victim browser to is…

    wakujs waku waku npm