CVE-2026-22030: React Router has CSRF issue in Action/Server Action Request Processing
React Router (or Remix v2) is vulnerable to CSRF attacks on document POST requests to UI routes when using server-side route action handlers in Framework Mode, or when using React Server Actions in the new unstable RSC modes.
> [!NOTE] > This does not impact applications that use Declarative Mode (<BrowserRouter>) or Data Mode (createBrowserRouter/<RouterProvider>).
Other sources
React Router is a router for React. In @remix-run/server-runtime version prior to 2.17.3. and react-router 7.0.0 through 7.11.0, React Router (or Remix v2) is vulnerable to CSRF attacks on document POST requests to UI routes when using server-side route action handlers in Framework Mode, or when using React Server Actions in the new unstable RSC modes. There is no impact if Declarative Mode (<BrowserRouter>) or Data Mode (createBrowserRouter/<RouterProvider>) is being used. This issue has been patched in @remix-run/server-runtime version 2.17.3 and react-router version 7.12.0.
— MITRE
React Router is a router for React. In @remix-run/server-runtime version prior to 2.17.3. and react-router 7.0.0 through 7.11.0, React Router (or Remix v2) is vulnerable to CSRF attacks on document POST requests to UI routes when using server-side route action handlers in Framework Mode, or when using React Server Actions in the new unstable RSC modes. There is no impact if Declarative Mode (BrowserRouter) or Data Mode (createBrowserRouter/RouterProvider) is being used. This issue has been patched in @remix-run/server-runtime version 2.17.3 and react-router version 7.12.0.
— IBM
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-22030?
CVE-2026-22030 has been classified as a medium severity vulnerability due to its impact on server-side document POST requests.
How do I fix CVE-2026-22030?
To fix CVE-2026-22030, update @remix-run/server-runtime to version 2.17.3 or later, or update react-router to version 7.12.0 or later.
What software is affected by CVE-2026-22030?
CVE-2026-22030 affects @remix-run/server-runtime versions up to 2.17.2 and react-router versions between 7.0.0 and 7.11.0.
What type of attacks does CVE-2026-22030 enable?
CVE-2026-22030 enables Cross-Site Request Forgery (CSRF) attacks on document POST requests.
In which modes is CVE-2026-22030 present?
CVE-2026-22030 is present in Framework Mode when using server-side route action handlers and in unstable React Server Actions modes.