Executive brief
Waku is a minimal React framework that handles HTTP redirects through an unstable_redirect() helper. This helper accepts URLs from user input but fails to validate them before using them in HTTP redirect responses. An attacker can craft a malicious link that tricks users into navigating to attacker-controlled websites, enabling phishing attacks, theft of credentials, and OAuth token compromise. The flaw affects all current versions and is remedied in the latest patch.
Technical details
The vulnerability is an open redirect (CWE-601) in the unstable_redirect(location, status?) function exported from waku/router/server (packages/waku/src/router/define-router.tsx:156–161). The function accepts an arbitrary string parameter, propagates it through createCustomError() and getErrorInfo() handlers, and reflects it directly into the HTTP Location response header without URL validation, scheme restriction, or path-only enforcement. The JSDoc comment claims "only URL pathname is supported" but no runtime validation enforces this constraint. An attacker who convinces a victim to click a crafted link can redirect the browser to an arbitrary external domain; scheme-relative URLs (//evil.example/) bypass naive allow-list filters. The vulnerability is exploitable across all Waku adapters (Node.js, Cloudflare Workers, Vercel Edge, Deno). A dynamic proof-of-concept confirmed the issue in Waku 1.0.0-beta.0. A patch is available in version 1.0.0-beta.1 (released 2026-05-26) that sanitizes the location argument.
Affected products
- Waku Waku <= 1.0.0-beta.0
Timeline
- 2026-07-08: disclosed: Advisory GHSA-43fc-v873-qw85 published
- 2026-05-26: patched: Fix released in Waku 1.0.0-beta.1