p PatchFirst

CVE-2026-39371

CVE-2026-39371 · RedwoodSDK has a CSRF vulnerability in server function dispatch via GET requests

This page contains facts from public vulnerability sources. Check the original advisory before updating.

RedwoodSDK is a server-first React framework. From 1.0.0-beta.50 to 1.0.5, erver functions exported from "use server" files could be invoked via GET requests, bypassing their intended HTTP method. In cookie-authenticated applications, this allowed cross-site GET navigations to trigger state-changing functions, because browsers send SameSite=Lax cookies on top-level GET requests. This affected all server functions -- both serverAction() handlers and bare exported functions in "use server" files. This vulnerability is fixed in 1.0.6.

CVSS 8.1 · High · EPSS 0.2% · Fix available

Published
Updated

Stack: node

Affected products and versions

  • sdk

    Versions
    • >= 1.0.0-beta.50, < 1.0.6: Affected

    No fix published

  • rwsdk npm

    Affected ranges
    • SEMVER: ≥ 1.0.0-beta.50, < 1.0.6

    Update to 1.0.6

Original sources

Check your server →