What’s Vulnerable › Vulnerabilities
CVE-2026-39371: RedwoodSDK has a CSRF vulnerability in server function dispatch via GET requests
- Severity: high (CVSS 8.1 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.2% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2026-04-07 · updated 2026-07-24
- Weakness: CWE-352
Description
RedwoodSDK is a server-first React framework. From 1.0.0-beta.50 to 1.0.5, erver functions exported from "use server" files could be invoked via GET requests, bypassing their intended HTTP method. In cookie-authenticated applications, this allowed cross-site GET navigations to trigger state-changing functions, because browsers send SameSite=Lax cookies on top-level GET requests. This affected all server functions -- both serverAction() handlers and bare exported functions in "use server" files. This vulnerability is fixed in 1.0.6.
Affected products
- redwoodjs sdk: from 1.0.1 before 1.0.6; 1.0.0-beta50, 1.0.0-beta51, 1.0.0-beta52, 1.0.0-beta53, 1.0.0-beta53_test20260205213024, 1.0.0-beta54 (+4) — fixed in 1.0.6
How to fix
Upgrade to a fixed version: redwoodjs sdk 1.0.6. Check the vendor advisory for mitigations.
References
Get alerted when CVE-2026-39371 or the next vulnerability affects your stack