CVE-2026-22030 Details
Description
React Router is a router for React. In @remix-run/server-runtime version prior to 2.17.3. and react-router 7.0.0 through 7.11.0, React Router (or Remix v2) is vulnerable to CSRF attacks on document POST requests to UI routes when using server-side route action handlers in Framework Mode, or when using React Server Actions in the new unstable RSC modes. There is no impact if Declarative Mode (<BrowserRouter>) or Data Mode (createBrowserRouter/<RouterProvider>) is being used. This issue has been patched in @remix-run/server-runtime version 2.17.3 and react-router version 7.12.0.
A Cross-Site Request Forgery (CSRF) vulnerability has been identified in React Router (versions 7.0.0 to 7.11.0) and in @remix-run/server-runtime (versions prior to 2.17.3). This vulnerability occurs in React Router when server-side route action handlers are used in Framework Mode, or when React Server Actions are employed in the unstable RSC modes. The issue arises on document POST requests to UI routes, creating a risk of CSRF attacks. However, applications using Declarative Mode with <BrowserRouter> or Data Mode with createBrowserRouter/<RouterProvider> are not affected.
Users can upgrade to @remix-run/server-runtime version 2.17.3 or react-router version 7.12.0 to address this vulnerability.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jan 12, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/remix-run/react-router/security/advisories/GHSA-h5cw-625j-3rxh | [email protected] | Vendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-352 | Cross-Site Request Forgery (CSRF) | [email protected] |
| CWE-346 | Origin Validation Error | [email protected] |
| CWE-352 | Cross-Site Request Forgery (CSRF) | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| shopify react-router | >= 7.0.0, <= 7.11.0 |
CPE
Remediation
| |
| shopify remix-run/react | < 2.17.3 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Feb 5, 2026 | Initial Analysis | [email protected] |
| Jan 10, 2026 | New CVE Received | [email protected] |