CVE-2026-53663
CVE-2026-53663 · React Router: `handleDocumentRequest` CSRF check covers `POST` only; PUT/PATCH/DELETE bypass
This page contains facts from public vulnerability sources. Check the original advisory before updating.
React Router is a router for React. From 7.12.0 until 7.15.1, certain CSRF checks in React Router v7 Framework Mode were insufficient and run on POST requests, but were bypassed on PUT/PATCH/DELETE requests. This is a low severity vulnerability because modern browser protections (CORS preflight, SameSite cookies) already block the cross-origin attack vectors that this missing CSRF check would otherwise gate. This vulnerability is fixed in 7.15.1.
CVSS 3.1 · Low · EPSS 0.1% · Fix available
- Published
- Updated
Stack: node
Affected products and versions
react-router
- Versions
- >= 7.12.0, < 7.15.1: Affected
No fix published
server-runtime
- Versions
- >= 2.17.3, < 2.17.5: Affected
No fix published
react-router npm
- Affected ranges
- SEMVER: ≥ 7.12.0, < 7.15.1
Update to 7.15.1
@remix-run/server-runtime npm
- Affected ranges
- SEMVER: ≥ 2.17.3, < 2.17.5
Update to 2.17.5