CVE-2026-22030
published 2026-01-10CVE-2026-22030: React Router is a router for React. In @remix-run/server-runtime version prior to 2.17.3. and react-router 7.0.0 through 7.11.0, React Router (or Remix v2) is…
PriorityP434medium6.5CVSS 3.1
AVNACLPRNUIRSUCNIHAN
EPSS
0.13%
2.8th percentile
React Router is a router for React. In @remix-run/server-runtime version prior to 2.17.3. and react-router 7.0.0 through 7.11.0, React Router (or Remix v2) is vulnerable to CSRF attacks on document POST requests to UI routes when using server-side route action handlers in Framework Mode, or when using React Server Actions in the new unstable RSC modes. There is no impact if Declarative Mode () or Data Mode (createBrowserRouter/) is being used. This issue has been patched in @remix-run/server-runtime version 2.17.3 and react-router version 7.12.0.
Affected
6 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| remix-run | react-router | — | — |
| remix-run | react-router | — | — |
| remix-run | react-router | >= 7.0.0 < 7.12.0 | 7.12.0 |
| remix-run | server-runtime | >= 0 < 2.17.3 | 2.17.3 |
| shopify | react-router | 7.0.0 – 7.11.0 | — |
| shopify | remix-run_react | < 2.17.3 | 2.17.3 |
CVSS provenance
nvdv3.16.5MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
vendor_redhat6.5MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
react-router: React Router CSRF in Action/Server Action Request Processing
vendor_redhat·2026-01-10·CVSS 6.5
CVE-2026-22030 [MEDIUM] CWE-352 react-router: React Router CSRF in Action/Server Action Request Processing
react-router: React Router CSRF in Action/Server Action Request Processing
React Router is a router for React. In @remix-run/server-runtime version prior to 2.17.3. and react-router 7.0.0 through 7.11.0, React Router (or Remix v2) is vulnerable to CSRF attacks on document POST requests to UI routes when using server-side route action handlers in Framework Mode, or when using React Server Actions in the new unstable RSC modes. There is no impact if Declarative Mode () or Data Mode (createBrowserRouter/) is being used. This issue has been patched in @remix-run/server-runtime version 2.17.3 and react-router version 7.12.0.
A cross site request forgery flaw has been discovered in the npm react-router package. React Router is vulnerable to CSRF attacks on document POST requests to UI routes w
GHSA
React Router has CSRF issue in Action/Server Action Request Processing
ghsa·2026-01-08
CVE-2026-22030 [MEDIUM] CWE-346 React Router has CSRF issue in Action/Server Action Request Processing
React Router has CSRF issue in Action/Server Action Request Processing
React Router (or Remix v2) is vulnerable to CSRF attacks on document POST requests to UI routes when using server-side route `action` handlers in [Framework Mode](https://reactrouter.com/start/modes#framework), or when using React Server Actions in the new unstable RSC modes.
> [!NOTE]
> This does not impact applications that use [Declarative Mode](https://reactrouter.com/start/modes#declarative) (``) or [Data Mode](https://reactrouter.com/start/modes#data) (`createBrowserRouter`/``).
OSV
React Router has CSRF issue in Action/Server Action Request Processing
osv·2026-01-08
CVE-2026-22030 [MEDIUM] React Router has CSRF issue in Action/Server Action Request Processing
React Router has CSRF issue in Action/Server Action Request Processing
React Router (or Remix v2) is vulnerable to CSRF attacks on document POST requests to UI routes when using server-side route `action` handlers in [Framework Mode](https://reactrouter.com/start/modes#framework), or when using React Server Actions in the new unstable RSC modes.
> [!NOTE]
> This does not impact applications that use [Declarative Mode](https://reactrouter.com/start/modes#declarative) (``) or [Data Mode](https://reactrouter.com/start/modes#data) (`createBrowserRouter`/``).
No detection rules found.
No public exploits indexed.
Wiz
CVE-2025-68470 Impact, Exploitability, and Mitigation Steps | Wiz
blogs_wiz·CVSS 7.6
CVE-2025-68470 [HIGH] CVE-2025-68470 Impact, Exploitability, and Mitigation Steps | Wiz
## CVE-2025-68470 :
React Router vulnerability analysis and mitigation
React Router is a router for React. In versions 6.0.0 through 6.30.1 and 7.0.0 through 7.9.5, an attacker-supplied path can be crafted so that when a React Router application navigates to it via navigate(), , or redirect(), the app performs a navigation/redirect to an external URL. This is only an issue if you are passing untrusted content into navigation paths in your application code. This issue has been patched in versions 6.30.2 and 7.9.6.
Source : NVD
## 6.5
Score
Published January 10, 2026
Severity MEDIUM
CNA Score 6.5
Affected Technologies
React Router
Linux Red Hat
Has Public Exploit No
Has CISA KEV Exploit No
CISA KEV Release Date N/A
CISA KEV Due Date N/A
Exploitation Probability Percentile (
Wiz
CVE-2026-22030 Impact, Exploitability, and Mitigation Steps | Wiz
blogs_wiz·CVSS 6.5
CVE-2026-22030 [MEDIUM] CVE-2026-22030 Impact, Exploitability, and Mitigation Steps | Wiz
## CVE-2026-22030 :
JavaScript vulnerability analysis and mitigation
React Router is a router for React. In @remix-run/server-runtime version prior to 2.17.3. and react-router 7.0.0 through 7.11.0, React Router (or Remix v2) is vulnerable to CSRF attacks on document POST requests to UI routes when using server-side route action handlers in Framework Mode, or when using React Server Actions in the new unstable RSC modes. There is no impact if Declarative Mode ( ) or Data Mode (createBrowserRouter/ ) is being used. This issue has been patched in @remix-run/server-runtime version 2.17.3 and react-router version 7.12.0.
Source : NVD
## 6.5
Score
Published January 10, 2026
Severity MEDIUM
CNA Score 6.5
Affected Technologies
JavaScript
React Router
Has Public Exploit No
Has CISA K
Bugzilla
CVE-2026-22030 react-router: React Router CSRF in Action/Server Action Request Processing
bugzilla·2026-01-10·CVSS 6.5
CVE-2026-22030 [MEDIUM] CVE-2026-22030 react-router: React Router CSRF in Action/Server Action Request Processing
CVE-2026-22030 react-router: React Router CSRF in Action/Server Action Request Processing
React Router is a router for React. In @remix-run/server-runtime version prior to 2.17.3. and react-router 7.0.0 through 7.11.0, React Router (or Remix v2) is vulnerable to CSRF attacks on document POST requests to UI routes when using server-side route action handlers in Framework Mode, or when using React Server Actions in the new unstable RSC modes. There is no impact if Declarative Mode () or Data Mode (createBrowserRouter/) is being used. This issue has been patched in @remix-run/server-runtime version 2.17.3 and react-router version 7.12.0.
2026-01-10
Published