Headline
GHSA-h5cw-625j-3rxh: React Router has CSRF issue in Action/Server Action Request Processing
React Router (or Remix v2) is vulnerable to CSRF attacks on document POST requests to UI routes when using server-side route action handlers in Framework Mode, or when using React Server Actions in the new unstable RSC modes.
[!NOTE] This does not impact applications that use Declarative Mode (
<BrowserRouter>) or Data Mode (createBrowserRouter/<RouterProvider>).
- GitHub Advisory Database
- GitHub Reviewed
- CVE-2026-22030
React Router has CSRF issue in Action/Server Action Request Processing
Moderate severity GitHub Reviewed Published Jan 8, 2026 in remix-run/react-router • Updated Jan 8, 2026
Package
npm @remix-run/server-runtime (npm)
Affected versions
<= 2.17.2
React Router (or Remix v2) is vulnerable to CSRF attacks on document POST requests to UI routes when using server-side route action handlers in Framework Mode, or when using React Server Actions in the new unstable RSC modes.
Note
This does not impact applications that use Declarative Mode (<BrowserRouter>) or Data Mode (createBrowserRouter/<RouterProvider>).
References
- GHSA-h5cw-625j-3rxh
Published to the GitHub Advisory Database
Jan 8, 2026