CSRF Vulnerability in React Router and Remix Server Actions
Summary
GHSA-h5cw-625j-3rxh: React Router has CSRF issue in Action/Server Action Request Processing. Affects react-router versions >= 7.0.0, < 7.12.0. Fixed in 7.12.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
React Router is a popular library for routing in React applications, enabling developers to create dynamic single-page applications with ease. It provides various modes, including Framework Mode and Declarative Mode, to cater to different application needs. The recent vulnerability affects the handling of document POST requests in Framework Mode and React Server Actions, potentially exposing applications to Cross-Site Request Forgery (CSRF) attacks.
Vulnerability Detail
The vulnerability arises from the way React Router and Remix handle server-side route action requests. When using action handlers in Framework Mode or React Server Actions, an attacker could exploit this by sending unauthorized requests to the server, leading to unintended actions being performed on behalf of the user. This could result in data manipulation or unauthorized access, compromising the integrity of the application.
How To Fix
Latest published version: 8.5.0 as of 23 Oct 2026
npm install react-router@8.5.0Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
7.12.0
This is the first release that contains the fix.
npm install react-router@7.12.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate updating is not feasible, consider implementing CSRF protection mechanisms, such as using anti-CSRF tokens in your forms and validating them on the server side. This can help mitigate the risk of CSRF attacks until the packages are updated.
Conclusion
The CSRF vulnerability in React Router and Remix Server Actions poses a significant risk to applications using these packages in Framework Mode. It is crucial to update to the latest patched versions to safeguard against potential attacks. Implementing additional security measures can further enhance protection until updates are applied.
See every vulnerability recorded for react-router →
FAQ
Cross-Site Request Forgery (CSRF) is an attack that tricks the user into executing unwanted actions on a web application in which they are authenticated.
You can check if your application is affected by using Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Visit Vulert Scanner to test your application.
Exploiting this vulnerability could allow attackers to perform unauthorized actions on behalf of users, potentially leading to data breaches or manipulation.
Yes, implementing CSRF protection mechanisms, such as anti-CSRF tokens, can help mitigate the risk until you can update the packages.
The CVSS score of this vulnerability is 6.5, indicating a moderate level of risk.
References
Related vulnerabilities
Recent vulnerabilities recorded for react-router.
