CSRF Bypass Vulnerability in React Router: Action Execution Before 400 Response
Summary
GHSA-qwww-vcr4-c8h2: React Router: RSC Mode CSRF Bypass Allows Action Execution Before 400 Response. Affects react-router versions >= 7.12.0, < 8.3.0. Fixed in 8.3.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
React Router is a popular routing library for React applications, enabling developers to create dynamic single-page applications with ease. It provides features such as nested routing, route matching, and code splitting. However, certain unstable APIs within React Router have been found to be vulnerable to Cross-Site Request Forgery (CSRF) attacks, particularly in the RSC (React Server Components) mode, which can lead to unauthorized action execution.
Vulnerability Detail
The vulnerability arises from a flaw in the unstable RSC code paths of React Router, allowing attackers to bypass CSRF protections. This means that an attacker could potentially execute actions on behalf of a user before the application receives a 400 response, leading to unauthorized operations. The issue is particularly concerning for applications utilizing the unstable RSC APIs, as it exposes them to risks of data manipulation and unauthorized access.
How To Fix
Latest published version: 8.5.0 as of 23 Oct 2026
npm install react-router@8.5.0Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
8.3.0
This is the first release that contains the fix.
npm install react-router@8.3.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, developers can implement additional CSRF protection mechanisms, such as validating CSRF tokens on the server side for sensitive actions, until the package is updated. This can help mitigate the risk of unauthorized actions being executed.
Conclusion
In summary, the CSRF bypass vulnerability in React Router's unstable RSC mode poses a significant risk to applications using affected versions. It is crucial to update to version 8.3.0 or later to ensure the security of your application. Additionally, utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for react-router →
FAQ
The CVSS score of this vulnerability is 7.1, indicating a high severity level.
Versions of React Router from 7.12.0 to 8.2.9 are affected by this vulnerability.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without any signup.
If exploited, this vulnerability could allow attackers to execute unauthorized actions on behalf of users, leading to data manipulation and security breaches.
Yes, implementing additional CSRF protection mechanisms, such as server-side validation of CSRF tokens, can help mitigate the risk until the package is updated.
References
Related vulnerabilities
Recent vulnerabilities recorded for react-router.
