CVE-2026-53663 Details
Description
React Router is a router for React. From 7.12.0 until 7.15.1, certain CSRF checks in React Router v7 Framework Mode were insufficient and run on POST requests, but were bypassed on PUT/PATCH/DELETE requests. This is a low severity vulnerability because modern browser protections (CORS preflight, SameSite cookies) already block the cross-origin attack vectors that this missing CSRF check would otherwise gate. This vulnerability is fixed in 7.15.1.
A vulnerability in React Router's v7 Framework Mode, present in versions 7.12.0 prior to 7.15.1, allows for cross-site request forgery (CSRF) attacks on PUT, PATCH, and DELETE requests. The issue arises because certain CSRF checks were inadequate and only applied to POST requests. Although this vulnerability is considered low severity—since modern browser protections like CORS preflight and SameSite cookies mitigate the cross-origin attack vectors involved—it still poses a risk in the affected versions.
Users can upgrade to React Router version 7.15.1 or later to address this vulnerability. For those using the @remix-run/server-runtime package, version 2.17.5 or later is recommended.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jun 22, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/remix-run/react-router/security/advisories/GHSA-84g9-w2xq-vcv6 | [email protected] |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-352 | Cross-Site Request Forgery (CSRF) | [email protected] |
Affected Products
No affected product data is available for this CVE.
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 22, 2026 | CVE Modified | CISA-ADP |
| Jun 22, 2026 | New CVE Received | [email protected] |