CVE-2026-53663: Remix React Router CSRF bypass on PUT, PATCH, and DELETE requests

CVE-2026-53663 · Severity: low · CVSS 3.1 · Published 2026-06-22

React Router is a popular library used to manage navigation and data handling in React web applications. A flaw in its security checks could allow an attacker to trick a user's browser into performing unintended actions, such as modifying or deleting data, if the user visits a malicious website. However, the risk is low because modern web browsers have built-in protections that prevent most versions of this attack.

Technologies: @remix-run/server-runtime (npm), Remix Server-Runtime. Vendors: npm, Remix.

Quick answers

Is CVE-2026-53663 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-53663 being exploited in the wild.
How severe is CVE-2026-53663?
Low severity, with a CVSS score of 3.1, published 22 June 2026.
Which products and versions are affected?
@remix-run/server-runtime (npm) >= 2.17.3, < 2.17.5, SEMVER:introduced=2.17.3,fixed=2.17.5; Remix Server-Runtime >= 2.17.3, < 2.17.5.
Is there a fix for CVE-2026-53663?
Yes. @remix-run/server-runtime (npm): upgrade to 2.17.5 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-53663 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-53663?
Check whether you run @remix-run/server-runtime (npm) or Remix Server-Runtime at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • @remix-run/server-runtime (npm): upgrade to 2.17.5 or later
    npm install @remix-run/server-runtime@2.17.5

Technical details

A Cross-Site Request Forgery (CSRF) vulnerability exists in React Router v7 Framework Mode (and @remix-run/server-runtime) due to insufficient validation of non-POST request methods. While POST requests were correctly validated, the framework failed to apply the same CSRF checks to PUT, PATCH, and DELETE document requests. An attacker could potentially exploit this by inducing a user to submit a cross-origin request to a vulnerable endpoint. The severity is rated low because modern browser security features, specifically SameSite cookie attributes and CORS preflight requirements for non-simple HTTP methods, significantly mitigate the practical exploitability of this flaw. The issue is resolved in React Router version 7.15.1 and @remix-run/server-runtime version 2.17.5.

Affected products

  • remix-run react-router >= 7.12.0, < 7.15.1
  • @remix-run server-runtime >= 2.17.3, < 2.17.5

Identifiers

  • CVE-2026-53663
  • GHSA-84g9-w2xq-vcv6

Timeline

  • 2026-06-02: advisory: GitHub advisory published by maintainers
  • 2026-06-22: disclosed: NVD publication date

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.