waku vulnerabilities
CVEs whose affected-version data names the waku package (npm). Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.
2 CVEsRSS
CVE-2026-49455Medium· 6.5Waku is the minimal React framework
Waku is the minimal React framework. Prior to version 1.0.0-beta.1, Waku's RSC request dispatcher invokes server actions without validating the request's Origin (or Sec-Fetch-Site) header. A cross-origin web attacker can therefore cause …
▾ Sunlitwaku · wakuEPSS 0.12%via NVD
CVE-2026-49456Low· 3.1Waku is the minimal React framework
Waku is the minimal React framework. Prior to version 1.0.0-beta.1, the unstable_redirect() helper exported from waku/router/server (packages/waku/src/router/define-router.tsx:156–161) accepts an arbitrary string and reflects it unchange…
▾ Sunlitwaku · wakuEPSS 0.30%via NVD