Potential Open Redirect in Waku npm Package
An early warning has been issued regarding a potential open redirect vulnerability in the `waku` npm package, specifically in the `unstable_redirect()` helper. This issue appears to allow user-controlled input to be reflected into the HTTP `Location` response header without proper validation.
What happened
The `unstable_redirect()` helper in the `waku` npm package is under investigation for reflecting user-controlled input into the HTTP `Location` response header without validation. This behavior reportedly leads to open redirect attacks. The affected version is `waku` npm package version 1.0.0-beta.0. It is recommended to avoid using the `unstable_redirect()` helper with untrusted input and to monitor for updates to the `waku` package that may address this vulnerability. For more detailed information, consult the primary sources.
How 0Day mitigates this
waku is anywhere in your dependency tree, the engineers who own the affected repositories get a push alert the moment it is flagged — no manual audit to remember to run.Read how this differs from waiting on a scanner to catch a known advisory, or see the exact, read-only access 0Day needs to do this for an organization.