@buttery/tokens (>=0.1.2, <=0.1.10), @common-stack/frontend-stack-react (>=6.0.6-alpha.23, <=10.0.1-alpha.0) +29 more potentially affected by CVE-2026-22030 via @remix-run/server-runtime (>=2.0.0, <=2.17.2)

🗓️ 08 Jan 2026 20:57:09Reported by Vulners OSVType

vulnersosv🔗 security.snyk.io👁 1 Views

@remix-run/server-runtime 2.0.0-2.17.2 vulnerable to prototype pollution leaking sensitive data.

Reporter	Title	Published	Views	Family All 28
IBM Security Bulletins	Security Bulletin: Investigation Assistant App for IBM QRadar SIEM is vulnerable to using components with known vulnerabilities	6 Apr 202617:16	–	ibm
IBM Security Bulletins	Security Bulletin: MongoDB Enterprised Advanced affected by: react-router-7.11.0.tgz (CVE-2026-21884, CVE-2026-22029, CVE-2026-22030)	11 May 202618:23	–	ibm
IBM Security Bulletins	Security Bulletin: Carbon Charts React Router Security Vulnerabilities	27 Apr 202607:14	–	ibm
IBM Security Bulletins	Security Bulletin: XSS Vulnerability in React Router meta()/Meta APIs During SSR, affects watsonx.data	10 Apr 202605:59	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple Vulnerabilities in React Router bundled with IBM Fusion, IBM Fusion HCI and IBM Fusion Data Cataloging	13 Jul 202622:40	–	ibm
Circl	CVE-2026-22030	10 Jan 202604:02	–	circl
CNNVD	react-router 跨站请求伪造漏洞	10 Jan 202600:00	–	cnnvd
CVE	CVE-2026-22030	10 Jan 202602:42	–	cve
Cvelist	CVE-2026-22030 React Router has CSRF issue in Action/Server Action Request Processing	10 Jan 202602:42	–	cvelist
EUVD	EUVD-2026-1464	10 Jan 202602:42	–	euvd

13 Jan 2026 14:33Current

5.4Medium risk

Vulners AI Score5.4

CVSS 3.16.5

EPSS0.00133

SSVC

remix-run/server-runtime prototype-pollution information-disclosure npm-package transitive-dependency