| Package | Affected versions | Patched versions |
|---|---|---|
| react-router | ≥ 7.0.0, ≤ 7.11.0 | |
| remix-run/react | < 2.17.3 | 2.17.3 |
| @remix-run/server-runtime | < 2.17.3 | 2.17.3 |
| react-router | ≥ 7.0.0, < 7.12.0 | 7.12.0 |
React Router (or Remix v2) is vulnerable to CSRF attacks on document POST requests to UI routes when using server-side route action handlers in Framework Mode, or when using React Server Actions in the new unstable RSC modes.
[!NOTE] This does not impact your application if you are using Declarative Mode (
<BrowserRouter>) or Data Mode (createBrowserRouter/<RouterProvider>).
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free