GHSA-h5cw-625j-3rxhMediumCVSS 6.5

React Router has CSRF issue in Action/Server Action Request Processing

Published
January 8, 2026
Last Modified
June 9, 2026

🔗 CVE IDs covered (1)

CVE-2026-22030 →

📋 Description

React Router (or Remix v2) is vulnerable to CSRF attacks on document POST requests to UI routes when using server-side route action handlers in Framework Mode, or when using React Server Actions in the new unstable RSC modes.

[!NOTE] This does not impact your application if you are using Declarative Mode (<BrowserRouter>) or Data Mode (createBrowserRouter/<RouterProvider>).

🎯 Affected products2

  • npm/react-router:>= 7.0.0, <= 7.11.0
  • npm/@remix-run/server-runtime:<= 2.17.2

🔗 References (3)