Cross-site Request Forgery

🗓️ 12 Jan 2026 08:26:11Reported by Veracode Vulnerability DatabaseType

CSRF flaw in React Router enables unauthorized POSTs on UI routes due to missing protections in server-side actions and React Server Actions.

Reporter	Title	Published	Views	Family All 24
IBM Security Bulletins	Security Bulletin: Investigation Assistant App for IBM QRadar SIEM is vulnerable to using components with known vulnerabilities	6 Apr 202617:16	–	ibm
IBM Security Bulletins	Security Bulletin: MongoDB Enterprised Advanced affected by: react-router-7.11.0.tgz (CVE-2026-21884, CVE-2026-22029, CVE-2026-22030)	11 May 202618:23	–	ibm
IBM Security Bulletins	Security Bulletin: Carbon Charts React Router Security Vulnerabilities	27 Apr 202607:14	–	ibm
IBM Security Bulletins	Security Bulletin: XSS Vulnerability in React Router meta()/Meta APIs During SSR, affects watsonx.data	10 Apr 202605:59	–	ibm
Circl	CVE-2026-22030	10 Jan 202604:02	–	circl
CNNVD	react-router 跨站请求伪造漏洞	10 Jan 202600:00	–	cnnvd
CVE	CVE-2026-22030	10 Jan 202602:42	–	cve
Cvelist	CVE-2026-22030 React Router has CSRF issue in Action/Server Action Request Processing	10 Jan 202602:42	–	cvelist
EUVD	EUVD-2026-1464	10 Jan 202602:42	–	euvd
Github Security Blog	React Router has CSRF issue in Action/Server Action Request Processing	8 Jan 202620:57	–	github

Vulners

Node

shopify react-routerRange7.0.0–7.12.0js

shopify react-routerRange7.0.0-pre.0–7.11.0js

shopify react-routerRange7.0.0–7.12.0-pre.0js

server-runtime @remix-run/server-runtimeRange0.0.0-experimental-01e349e01–2.17.2js

Source	Link
github	www.github.com/remix-run/react-router/commit/75b1ef50867d8fa3d5ffdab28245d5fec307d6a7
github	www.github.com/remix-run/react-router/security/advisories/GHSA-h5cw-625j-3rxh

30 May 2026 05:48Current

6.7Medium risk

Vulners AI Score6.7

CVSS 3.16.5

EPSS0.00028

SSVC