CVE-2026-39371 redwoodjs CVE debrief

Who should care

Developers and administrators using RedwoodSDK versions between 1.0.0-beta.50 and 1.0.5 should be aware of this vulnerability. Given the high CVSS score of 8.1, this issue should be prioritized for patching to prevent potential cross-site request forgery (CSRF) attacks. Particular attention should be given to cookie-authenticated applications, as they are more susceptible to exploitation.

Technical summary

CVE-2026-39371 is a high-severity vulnerability in RedwoodSDK, a server-first React framework. The issue arises from the improper handling of server functions exported from 'use server' files. These functions could be invoked via GET requests, bypassing their intended HTTP method. This vulnerability is particularly problematic in cookie-authenticated applications, as browsers send SameSite=Lax cookies on top-level GET requests, allowing cross-site GET navigations to trigger state-changing functions. The vulnerability affects all server functions, including serverAction() handlers and bare exported functions in 'use server' files. The CVSS vector for this vulnerability is CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H, indicating a high severity level. The vulnerability has been fixed in RedwoodSDK version 1.0.6.

Defensive priority

High

Recommended defensive actions

• Upgrade to RedwoodSDK version 1.0.6 or later
• Review and update server functions in 'use server' files to ensure proper HTTP method handling
• Implement additional CSRF protections for cookie-authenticated applications
• Monitor for suspicious GET requests to server functions
• Verify that all server functions are properly secured and not vulnerable to cross-site request forgery

Evidence notes

The CVE record was published on 2026-04-07T20:16:31.980Z and was last modified on 2026-07-24T21:10:00.143Z. The NVD entry is currently Analyzed. The vulnerability details were obtained from the NVD and the vendor advisory on GitHub.

Official resources