remix-run/react-router · Security
React Router: Potential CSRF via PUT/PATCH/DELETE document requests
- GHSA ID
- GHSA-84g9-w2xq-vcv6
- CVE ID
- CVE-2026-53663
- Severity
- low
- Published
- Updated
- CVSS
- 3.1 · CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N
- CVSS v3
- 3.1 · CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N
Description
Certain CSRF checks in React Router v7 Framework Mode were insufficient and run on POST requests, but were bypassed on PUT/PATCH/DELETE requests. This is a low severity vulnerability because modern browser protections (CORS preflight, SameSite cookies) already block the cross-origin attack vectors that this missing CSRF check would otherwise gate.
[!NOTE] This does not impact your React Router application if you are using Declarative Mode (
<BrowserRouter>) or Data Mode (createBrowserRouter/<RouterProvider>).
CWEs
- CWE-352 · Cross-Site Request Forgery (CSRF)