CVE-2026-39371: Redwoodjs Redwoodsdk

High severity, CVSS 8.1. EPSS: 0.2% chance of exploitation in the next 30 days.

RedwoodSDK is a server-first React framework. From 1.0.0-beta.50 to 1.0.5, erver functions exported from "use server" files could be invoked via GET requests, bypassing their intended HTTP method. In cookie-authenticated applications, this allowed cross-site GET navigations to trigger state-changing functions, because browsers send SameSite=Lax cookies on top-level GET requests. This affected all server functions -- both serverAction() handlers and bare exported functions in "use server" files. This vulnerability is fixed in 1.0.6.

Affected products

• Redwoodjs Redwoodsdk: from 1.0.1, before 1.0.6 (fixed in 1.0.6); version 1.0.0 only

Published 2026-04-07. Last modified 2026-07-24.