{"id":"CVE-2026-49455","title":"Waku is the minimal React framework","summary":"Waku is the minimal React framework. Prior to version 1.0.0-beta.1, Waku's RSC request dispatcher invokes server actions without validating the request's Origin (or Sec-Fetch-Site) header. A cross-origin web attacker can therefore cause …","severity":"medium","cvss":6.5,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N","cwe":["CWE-352"],"vendor":"waku","product":"waku","affected":["waku <= 1.0.0-beta.0"],"patched":["waku 1.0.0-beta.1"],"published":"2026-09-03","updated":"2026-09-09","sourceUpdated":"2026-09-09T20:20:21.673","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-49455","references":[{"url":"https://github.com/wakujs/waku/releases/tag/v1.0.0-beta.1","label":"security-advisories@github.com"},{"url":"https://github.com/wakujs/waku/security/advisories/GHSA-75w3-gmqx-993q","label":"security-advisories@github.com"},{"url":"https://github.com/advisories/GHSA-75w3-gmqx-993q"}],"tags":["nvd","ghsa","npm"],"epss":0.00119,"epssPercentile":0.02043,"aliases":["GHSA-75w3-gmqx-993q"],"ecosystem":"npm","ingestedAt":"2026-07-08T20:46:41.593Z","slug":"CVE-2026-49455","body":"## Overview\n\nWaku is the minimal React framework. Prior to version 1.0.0-beta.1, Waku's RSC request dispatcher invokes server actions without validating the request's Origin (or Sec-Fetch-Site) header. A cross-origin web attacker can therefore cause a victim browser to issue an authenticated POST to a registered server action endpoint using a CORS-safelisted content type (text/plain), which does not trigger a preflight. Any state-mutating server action that the application exposes via 'use server' can be invoked with the victim's cookies attached. This issue has been patched in version 1.0.0-beta.1.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n## Package advisory (CVE-2026-49455)\n\nAffected packages:\n\n- `waku <= 1.0.0-beta.0`\n\nPatched in:\n\n- `waku 1.0.0-beta.1`\n\nSource: https://github.com/advisories/GHSA-75w3-gmqx-993q","depth":"sunlit","depthScore":36,"depthScoreParts":{"impact":35.8,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}