medium6.5
CVE-2026-22030
React Router has CSRF issue in Action/Server Action Request Processing
Impact
React Router (or Remix v2) is vulnerable to CSRF attacks on document POST requests to UI routes when using server-side route `action` handlers in [Framework Mode](https://reactrouter.com/start/modes#framework), or when using React Server Actions in the new unstable RSC modes. > [!NOTE] > This does not impact your application if you are using [Declarative Mode](https://reactrouter.com/start/modes#declarative) (`<BrowserRouter>`) or [Data Mode](https://reactrouter.com/start/modes#data) (`createBrowserRouter`/`<RouterProvider>`).
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| npm | react-router | >= 7.0.0, <= 7.11.0 | 7.12.0 |
| npm | @remix-run/server-runtime | <= 2.17.2 | 2.17.3 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Shopify | React-Router | from 7.0.0 through 7.11.0 |
| Shopify | Remix-Run\/React | before 2.17.3 |