| Package | Affected versions | Patched versions |
|---|---|---|
| @remix-run/server-runtime | ≥ 2.17.3, < 2.17.5 | 2.17.5 |
| react-router | ≥ 7.12.0, < 7.15.1 | 7.15.1 |
Certain CSRF checks in React Router v7 Framework Mode were insufficient and run on POST requests, but were bypassed on PUT/PATCH/DELETE requests. This is a low severity vulnerability because modern browser protections (CORS preflight, SameSite cookies) already block the cross-origin attack vectors that this missing CSRF check would otherwise gate.
[!NOTE] This does not impact your React Router application if you are using Declarative Mode (
<BrowserRouter>) or Data Mode (createBrowserRouter/<RouterProvider>).
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free