React Router: RSC Mode CSRF Bypass Allows Action Execution Before 400 Response

🗓️ 24 Jul 2026 16:44:43Reported by GitHub Advisory DatabaseType

Addresses CSRF bypass in React Server Components mode enabling action before 400 responses.

Reporter	Title	Published	Views	Family All 27
IBM Security Bulletins	Security Bulletin: Investigation Assistant App for IBM QRadar SIEM is vulnerable to using components with known vulnerabilities	6 Apr 202617:16	–	ibm
IBM Security Bulletins	Security Bulletin: MongoDB Enterprised Advanced affected by: react-router-7.11.0.tgz (CVE-2026-21884, CVE-2026-22029, CVE-2026-22030)	11 May 202618:23	–	ibm
IBM Security Bulletins	Security Bulletin: Carbon Charts React Router Security Vulnerabilities	27 Apr 202607:14	–	ibm
IBM Security Bulletins	Security Bulletin: XSS Vulnerability in React Router meta()/Meta APIs During SSR, affects watsonx.data	10 Apr 202605:59	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple Vulnerabilities in React Router bundled with IBM Fusion, IBM Fusion HCI and IBM Fusion Data Cataloging	13 Jul 202622:40	–	ibm
Circl	CVE-2026-22030	10 Jan 202604:02	–	circl
CNNVD	react-router 跨站请求伪造漏洞	10 Jan 202600:00	–	cnnvd
CVE	CVE-2026-22030	10 Jan 202602:42	–	cve
Cvelist	CVE-2026-22030 React Router has CSRF issue in Action/Server Action Request Processing	10 Jan 202602:42	–	cvelist
EUVD	EUVD-2026-1464	10 Jan 202602:42	–	euvd

Vulners

Node

shopify react-routerRange7.12.0–8.3.0npm

Source	Link
github	www.github.com/remix-run/react-router/security/advisories/GHSA-qwww-vcr4-c8h2
github	www.github.com/remix-run/react-router/commit/7a71c728ad116bd78699a258b2014ce9585729f5
github	www.github.com/remix-run/react-router/blob/main/CHANGELOG.md
github	www.github.com/remix-run/react-router/releases/tag/[email protected]
github	www.github.com/remix-run/react-router/pull/15311
github	www.github.com/advisories/GHSA-qwww-vcr4-c8h2

24 Jul 2026 16:44Current

5.8Medium risk

Vulners AI Score5.8

CVSS 3.16.5

EPSS0.00128

SSVC