Packages / react-router / Security

LowVulnerabilityGHSA-84g9-w2xq-vcv6CVE-2026-53663Published 15 Jun 2026

React Router: Potential CSRF via PUT/PATCH/DELETE document requests

Affected releases · react-router

  • 7.x7.12.0 – 7.15.0Fixed in 7.15.1

On 7.x, the newest line:

npm install react-router@7.15.1
8.x

  1. Not affected

    8.0.0 – 8.5.0

    8 releases, latest

7.x

  1. Not affected

    7.0.0 – 7.11.0

    36 releases

  2. Affected

    7.12.0 – 7.15.0

    8 releases

  3. Fixed

    7.15.1 – 7.18.4

    8 releases

228 stable releases of react-router, oldest to newest, one row per major.

Is your project affected?

Paste your package.json, or type the range you declare for react-router. It is read in your browser and sent nowhere.

What happens

Certain CSRF checks in React Router v7 Framework Mode were insufficient and run on POST requests, but were bypassed on PUT/PATCH/DELETE requests. This is a low severity vulnerability because modern browser protections (CORS preflight, SameSite cookies) already block the cross-origin attack vectors that this missing CSRF check would otherwise gate.

[!NOTE] This does not impact your React Router application if you are using Declarative Mode (<BrowserRouter>) or Data Mode (createBrowserRouter/<RouterProvider>).