HighGHSA-qwww-vcr4-c8h2
React Router: RSC Mode CSRF Bypass Allows Action Execution Before 400 Response
Published 24 Jul 2026 · Updated 10 Sept 2026
Affected packages
react-routernpm
- Affected
- >=7.12.0 <7.18.2
- Fixed in
- 7.18.2
Update to the fixed version for your release line, for example:
npm install react-router@7.18.2react-routernpm
- Affected
- >=8.0.0 <8.3.0
- Fixed in
- 8.3.0
Update to the fixed version for your release line, for example:
npm install react-router@8.3.0Details
This is a follow up to CVE-2026-22030 to address related CSRF flows in unstable RSC code paths.
> [!NOTE] > This only affects your application if you are using the unstable RSC APIs
Is GHSA-qwww-vcr4-c8h2 in any of your client repos?
Checking one package by hand is fine. Checking it across forty client projects is not. NPMscan reads the lockfiles in every GitHub repo you pick, finds each project with an affected react-router, and gives you the command that fixes it.
References
- Linkgithub.com/remix-run/react-router/security/advisories/GHSA-qwww-vcr4-c8h2
- Linkgithub.com/remix-run/react-router/pull/15353
- Linkgithub.com/remix-run/react-router/commit/7a71c728ad116bd78699a258b2014ce9585729f5
- Linkgithub.com/remix-run/react-router/commit/8ebd5df9932854547963e3255c8454e62430e05d
- Packagegithub.com/remix-run/react-router
- Linkgithub.com/remix-run/react-router/blob/main/CHANGELOG.md#v830
- Linkgithub.com/remix-run/react-router/blob/v7/CHANGELOG.md#v7182
- Linkgithub.com/remix-run/react-router/releases/tag/react-router%407.18.2
- Linkgithub.com/remix-run/react-router/releases/tag/react-router@8.3.0
- Linkgithub.com/remix-run/react-router/pull/15311
Advisory data from OSV.dev (opens OSV.dev in a new tab), refreshed daily.