{"id":"CVE-2026-49456","title":"Waku is the minimal React framework","summary":"Waku is the minimal React framework. Prior to version 1.0.0-beta.1, the unstable_redirect() helper exported from waku/router/server (packages/waku/src/router/define-router.tsx:156–161) accepts an arbitrary string and reflects it unchange…","severity":"low","cvss":3.1,"cvssVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N","cwe":["CWE-601"],"vendor":"waku","product":"waku","affected":["waku <= 1.0.0-beta.0"],"patched":["waku 1.0.0-beta.1"],"published":"2026-09-03","updated":"2026-09-09","sourceUpdated":"2026-09-09T20:20:21.673","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-49456","references":[{"url":"https://github.com/wakujs/waku/pull/2090","label":"security-advisories@github.com"},{"url":"https://github.com/wakujs/waku/releases/tag/v1.0.0-beta.1","label":"security-advisories@github.com"},{"url":"https://github.com/wakujs/waku/security/advisories/GHSA-43fc-v873-qw85","label":"security-advisories@github.com"},{"url":"https://github.com/advisories/GHSA-43fc-v873-qw85"}],"tags":["nvd","ghsa","npm"],"epss":0.003,"epssPercentile":0.22917,"aliases":["GHSA-43fc-v873-qw85"],"ecosystem":"npm","ingestedAt":"2026-07-08T20:46:41.589Z","slug":"CVE-2026-49456","body":"## Overview\n\nWaku is the minimal React framework. Prior to version 1.0.0-beta.1, the unstable_redirect() helper exported from waku/router/server (packages/waku/src/router/define-router.tsx:156–161) accepts an arbitrary string and reflects it unchanged into the HTTP Location response header with no URL validation, scheme restriction, or path-only enforcement. Any application that passes user-controlled input to this helper — the natural pattern documented in the JSDoc and official fixtures — is vulnerable to open redirect attacks. An attacker who convinces a victim to click a crafted link can silently redirect the browser to an arbitrary external domain, enabling phishing, credential harvesting, and OAuth token theft. Additionally, scheme-relative URLs (//evil.example/) bypass naive https?://-only allow-list filters that developers might add as ad-hoc mitigations. This issue has been patched in version 1.0.0-beta.1.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n## Package advisory (CVE-2026-49456)\n\nAffected packages:\n\n- `waku <= 1.0.0-beta.0`\n\nPatched in:\n\n- `waku 1.0.0-beta.1`\n\nSource: https://github.com/advisories/GHSA-43fc-v873-qw85","depth":"sunlit","depthScore":17,"depthScoreParts":{"impact":17.1,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}