remix-run/react-router · Security
React Router has CSRF issue in Action/Server Action Request Processing
- GHSA ID
- GHSA-h5cw-625j-3rxh
- CVE ID
- CVE-2026-22030
- Severity
- medium
- Published
- Updated
- CVSS
- 6.5 · CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
- CVSS v3
- 6.5 · CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
Description
React Router (or Remix v2) is vulnerable to CSRF attacks on document POST requests to UI routes when using server-side route action handlers in Framework Mode, or when using React Server Actions in the new unstable RSC modes.
[!NOTE] This does not impact your application if you are using Declarative Mode (
<BrowserRouter>) or Data Mode (createBrowserRouter/<RouterProvider>).
CWEs
- CWE-346 · Origin Validation Error
- CWE-352 · Cross-Site Request Forgery (CSRF)