CVE-2026-39371 Details
Description
RedwoodSDK is a server-first React framework. From 1.0.0-beta.50 to 1.0.5, erver functions exported from "use server" files could be invoked via GET requests, bypassing their intended HTTP method. In cookie-authenticated applications, this allowed cross-site GET navigations to trigger state-changing functions, because browsers send SameSite=Lax cookies on top-level GET requests. This affected all server functions -- both serverAction() handlers and bare exported functions in "use server" files. This vulnerability is fixed in 1.0.6.
A cross-site request forgery vulnerability has been identified in RedwoodSDK versions 1.0.0-beta.50 prior to 1.0.5. This issue allows server functions exported from 'use server' files to be invoked via GET requests, bypassing their intended HTTP method. In applications using cookie-based authentication, this could enable cross-site GET navigations to trigger state-changing functions, as browsers send SameSite=Lax cookies with top-level GET requests. The vulnerability affects all server functions, including both serverAction() handlers and bare exported functions in 'use server' files.
Users are advised to update to RedwoodSDK version 1.0.6, which fixes the vulnerability by enforcing the correct HTTP method for server function requests. No changes to application code are necessary.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Apr 8, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/redwoodjs/sdk/security/advisories/GHSA-x8rx-789c-2pxq | [email protected] | Vendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-352 | Cross-Site Request Forgery (CSRF) | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| redwoodjs redwoodsdk | >= 1.0.1, < 1.0.6 1.0.0 beta50 1.0.0 beta51 1.0.0 beta52 1.0.0 beta53 1.0.0 beta53_test20260205213024 1.0.0 beta54 1.0.0 beta55 1.0.0 beta56 1.0.0 beta57 1.0.0 beta58 |
CPE
Remediation
| |
Change History
6 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 24, 2026 | CVE Translated | [email protected] |
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| May 5, 2026 | Reanalysis | [email protected] |
| Apr 24, 2026 | Initial Analysis | [email protected] |
| Apr 7, 2026 | New CVE Received | [email protected] |