GitHub Advisoryadvisory · npm

GHSA-h5cw-625j-3rxh React Router has CSRF issue in Action/Server Action Request Processing

MEDIUM Published 2026-01-08 Modified 2026-06-09 Official page ↗
Aliases
CVE-2026-22030
Ecosystem
npm
Packages
react-router, @remix-run/server-runtime
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
Weaknesses
CWE-346, CWE-352
Reviewed
2026-01-08

Affected packages

• npm react-router: >= 7.0.0, < 7.12.0 → fixed in 7.12.0 • npm @remix-run/server-runtime: < 2.17.3 → fixed in 2.17.3

Description

React Router (or Remix v2) is vulnerable to CSRF attacks on document POST requests to UI routes when using server-side route `action` handlers in Framework Mode, or when using React Server Actions in the new unstable RSC modes. > [!NOTE] > This does not impact your application if you are using Declarative Mode (``) or Data Mode (`createBrowserRouter`/``).

Related

Alias · CVE (1)

Weakness · CWE (2)

  • CWE-346 Origin Validation Error weakness
  • CWE-352 Cross-Site Request Forgery weakness

References