CVE-2026-53663

React Router: `handleDocumentRequest` CSRF check covers `POST` only; PUT/PATCH/DELETE bypass

Published Jun 22, 2026 CVSS 3.1 · 3.1 Low EPSS < 1% KEV · Not listed

Description

React Router is a router for React. From 7.12.0 until 7.15.1, certain CSRF checks in React Router v7 Framework Mode were insufficient and run on POST requests, but were bypassed on PUT/PATCH/DELETE requests. This is a low severity vulnerability because modern browser protections (CORS preflight, SameSite cookies) already block the cross-origin attack vectors that this missing CSRF check would otherwise gate. This vulnerability is fixed in 7.15.1.

Analysis

Technical impact

The vulnerability is a missing CSRF verification that only applies to POST requests; PUT, PATCH or DELETE requests bypass the check, potentially allowing state‑changing actions from a cross‑origin request. Modern browser mechanisms such as SameSite cookies and CORS preflight largely mitigate the risk, which is why the impact is rated as low severity.

Affected Systems

Affected are the @remix‑run:server-runtime and remix‑run:react‑router packages from version 7.12.0 up to and including 7.15.1 when operating in Framework Mode. Packages newer than 7.15.1 are not affected.

Risk and Exploitability

The CVSS score is 3.1, reflecting low overall risk. The EPSS score is unavailable. The vulnerability is not listed in the CISA KEV catalog. Because the CSRF check is only enforced on POST, the inferred attack vector is attempting to send non‑POST requests from a malicious origin, but without browser protections it is unlikely. Modern SameSite cookie policies and CORS preflight headers generally block such attempts.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

remix-run

react-router

affected

Version	Status	Constraints
`>= 7.12.0, < 7.15.1`	affected	—

@remix-run

server-runtime

affected

Version	Status	Constraints
`>= 2.17.3, < 2.17.5`	affected	—

No data.

Vendor Product Versions

Remix-run

React-router

Version	Status	Scheme	Platform
`[7.12.0,7.15.1)`	affected	semver	—

Remix-run

Server-runtime

Version	Status	Scheme	Platform
`[2.17.3,2.17.5)`	affected	semver	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade @remix‑run:server-runtime and remix‑run:react‑router to version 7.15.1 or later
If immediate update is impossible, add server‑side CSRF validation on all state‑changing endpoints including PUT, PATCH and DELETE
Ensure session cookies use SameSite=Lax or Strict and that CORS policies are restrictive

Generated by OpenCVE AI on June 22, 2026 at 20:50 UTC.

Tracking

Advisories

Source	ID	Title
Github GHSA	GHSA-84g9-w2xq-vcv6	React Router: Potential CSRF via PUT/PATCH/DELETE document requests

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity High

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact Low

Availability Impact None

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.148% probability within 30 days)

Exploitation none

Automatable no

Technical Impact partial

References

Link	Providers
https://github.com/remix-run/react-router/security/advisories/GHSA-84g9-w2xq-vcv6
https://nvd.nist.gov/vuln/detail/CVE-2026-53663
https://www.cve.org/CVERecord?id=CVE-2026-53663

History

Jun 24, 2026 12:15 AM Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
References		https://nvd.nist.gov/vuln/detail/CVE-2026-53663 https://www.cve.org/CVERecord?id=CVE-2026-53663
Metrics	threat_severity `None`	threat_severity `Low`

Jun 22, 2026 9:30 PM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Remix-run Remix-run react-router Remix-run server-runtime
Vendors & Products		Remix-run Remix-run react-router Remix-run server-runtime

Jun 22, 2026 8:30 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Jun 22, 2026 6:45 PM Description updated. Title updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		React Router is a router for React. From 7.12.0 until 7.15.1, certain CSRF checks in React Router v7 Framework Mode were insufficient and run on POST requests, but were bypassed on PUT/PATCH/DELETE requests. This is a low severity vulnerability because modern browser protections (CORS preflight, SameSite cookies) already block the cross-origin attack vectors that this missing CSRF check would otherwise gate. This vulnerability is fixed in 7.15.1.
Title		React Router: `handleDocumentRequest` CSRF check covers `POST` only; PUT/PATCH/DELETE bypass
Weaknesses		CWE-352
References		https://github.com/remix-run/react-router/security/advisories/GHSA-84g9-w2xq-vcv6
Metrics		cvssV3_1 `{'score': 3.1, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N'}`