Executive brief
Waku, a React framework, contains a vulnerability in how it handles server-side actions. An attacker can trick a logged-in user's browser into performing unauthorized actions on the application, such as modifying data, by bypassing standard security checks. This could lead to unauthorized changes to user accounts or application state without the user's knowledge.
Technical details
A Cross-Site Request Forgery (CSRF) vulnerability exists in Waku's React Server Components (RSC) request dispatcher. The dispatcher in `packages/waku/src/lib/utils/request.ts` invokes server actions without validating the `Origin` or `Sec-Fetch-Site` headers. An attacker can use a CORS-safelisted content type like `text/plain` or a standard HTML form (`multipart/form-data`) to trigger a `POST` request that bypasses preflight checks. This allows the attacker to execute any `'use server'` action with the victim's authenticated cookies. The vulnerability is confirmed in version 1.0.0-beta.0 and fixed in 1.0.0-beta.1.
Affected products
- wakujs waku <= 1.0.0-beta.0
Timeline
- 2026-05-15: disclosed: Vulnerability discovered by reporter j0hndo.
- 2026-06-01: advisory: GitHub Advisory published.
- 2026-07-08: patched: Advisory updated and fix confirmed in 1.0.0-beta.1.