CVE-2026-22030: React Router CSRF in Action and Server Action Request Processing

Executive brief

React Router and Remix are popular tools used to build web applications. A security flaw allows attackers to trick users into performing unintended actions on a website, such as submitting forms or changing data without their consent. This occurs when the application uses specific server-side data handling features without proper origin verification.

Technical details

A Cross-Site Request Forgery (CSRF) vulnerability exists in React Router (and Remix v2) due to improper origin validation during the processing of document POST requests. The issue specifically affects applications using server-side route 'action' handlers in Framework Mode or React Server Actions in unstable RSC modes. An attacker can exploit this by inducing a victim to submit a cross-origin request, leading to unauthorized state changes on the server. Applications using Declarative Mode or Data Mode are not affected. Patches are available in react-router version 7.12.0 and @remix-run/server-runtime version 2.17.3.

Affected products

• remix-run react-router >= 7.0.0, <= 7.11.0
• remix-run @remix-run/server-runtime <= 2.17.2

Timeline

• 2026-01-08: disclosed
• 2026-01-08: advisory
• 2026-01-08: patched

References

• https://api.github.com/users/Oceandust
• https://github.com/Oceandust
• https://api.github.com/users/Oceandust/gists%7B/gist_id%7D
• https://api.github.com/users/Oceandust/repos
• https://avatars.githubusercontent.com/u/67463266?v=4
• https://api.github.com/users/Oceandust/events%7B/privacy%7D