PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-39371 redwoodjs CVE debrief

The RedwoodSDK, a server-first React framework, has a high-severity vulnerability tracked as CVE-2026-39371. This vulnerability affects versions from 1.0.0-beta.50 to 1.0.5, where server functions exported from 'use server' files could be invoked via GET requests, bypassing their intended HTTP method. In cookie-authenticated applications, this allowed cross-site GET navigations to trigger state-changing functions because browsers send SameSite=Lax cookies on top-level GET requests. This issue impacts all server functions, including serverAction() handlers and bare exported functions in 'use server' files. The vulnerability is fixed in version 1.0.6.

Vendor
redwoodjs
Product
sdk
CVSS
HIGH 8.1
CISA KEV
Not listed in stored evidence
Original CVE published
2026-04-07
Original CVE updated
2026-07-24
Advisory published
2026-04-07
Advisory updated
2026-07-24

Who should care

Developers and administrators using RedwoodSDK versions between 1.0.0-beta.50 and 1.0.5 should be aware of this vulnerability. Given the high CVSS score of 8.1, this issue should be prioritized for patching to prevent potential cross-site request forgery (CSRF) attacks. Particular attention should be given to cookie-authenticated applications, as they are more susceptible to exploitation.

Technical summary

CVE-2026-39371 is a high-severity vulnerability in RedwoodSDK, a server-first React framework. The issue arises from the improper handling of server functions exported from 'use server' files. These functions could be invoked via GET requests, bypassing their intended HTTP method. This vulnerability is particularly problematic in cookie-authenticated applications, as browsers send SameSite=Lax cookies on top-level GET requests, allowing cross-site GET navigations to trigger state-changing functions. The vulnerability affects all server functions, including serverAction() handlers and bare exported functions in 'use server' files. The CVSS vector for this vulnerability is CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H, indicating a high severity level. The vulnerability has been fixed in RedwoodSDK version 1.0.6.

Defensive priority

High

Recommended defensive actions

  • Upgrade to RedwoodSDK version 1.0.6 or later
  • Review and update server functions in 'use server' files to ensure proper HTTP method handling
  • Implement additional CSRF protections for cookie-authenticated applications
  • Monitor for suspicious GET requests to server functions
  • Verify that all server functions are properly secured and not vulnerable to cross-site request forgery

Evidence notes

The CVE record was published on 2026-04-07T20:16:31.980Z and was last modified on 2026-07-24T21:10:00.143Z. The NVD entry is currently Analyzed. The vulnerability details were obtained from the NVD and the vendor advisory on GitHub.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-39371 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-39371

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-39371 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-39371

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.