Executive brief
React Router is a popular library used to manage navigation and data handling in React web applications. A flaw in its security checks could allow an attacker to trick a user's browser into performing unintended actions, such as modifying or deleting data, if the user visits a malicious website. However, the risk is low because modern web browsers have built-in protections that prevent most versions of this attack.
Technical details
A Cross-Site Request Forgery (CSRF) vulnerability exists in React Router v7 Framework Mode (and @remix-run/server-runtime) due to insufficient validation of non-POST request methods. While POST requests were correctly validated, the framework failed to apply the same CSRF checks to PUT, PATCH, and DELETE document requests. An attacker could potentially exploit this by inducing a user to submit a cross-origin request to a vulnerable endpoint. The severity is rated low because modern browser security features, specifically SameSite cookie attributes and CORS preflight requirements for non-simple HTTP methods, significantly mitigate the practical exploitability of this flaw. The issue is resolved in React Router version 7.15.1 and @remix-run/server-runtime version 2.17.5.
Affected products
- remix-run react-router >= 7.12.0, < 7.15.1
- @remix-run server-runtime >= 2.17.3, < 2.17.5
Timeline
- 2026-06-02: advisory: GitHub advisory published by maintainers
- 2026-06-22: disclosed: NVD publication date