CVE-2026-49455

Name of the Vulnerable Software and Affected Versions Waku versions prior to 1.0.0-beta.1

Description The RSC request dispatcher fails to validate the Origin or Sec-Fetch-Site headers when invoking server actions. This allows a cross-origin attacker to trick a victim's browser into sending an authenticated POST request to a registered server action endpoint. By using a CORS-safelisted content type such as text/plain, the attacker can bypass preflight checks. Consequently, any state-mutating server action exposed via use server can be executed using the victim's cookies. This issue also affects the progressive-enhancement path where cross-origin HTML forms submitting multipart/form-data can reach the dispatcher. The flaw is present across all HTTP adapters, including Node, Cloudflare, Vercel, and Edge.

Recommendations Update to version 1.0.0-beta.1. As a temporary mitigation, deploy a reverse proxy or middleware that validates the Origin header and rejects POST requests to the rscBase prefix if the header does not match the application host.