Packages / react-router / Security

HighVulnerabilityGHSA-qwww-vcr4-c8h2Published 24 Jul 2026

React Router: RSC Mode CSRF Bypass Allows Action Execution Before 400 Response

Affected releases · react-router

  • 8.x8.0.0 – 8.2.0Fixed in 8.3.0
  • 7.x7.12.0 – 7.18.1Fixed in 7.18.2

On 8.x, the newest line:

npm install react-router@8.3.0
8.x

  1. Affected

    8.0.0 – 8.2.0

    4 releases

  2. Fixed

    8.3.0 – 8.5.0

    4 releases, latest

7.x

  1. Not affected

    7.0.0 – 7.11.0

    36 releases

  2. Affected

    7.12.0 – 7.18.1

    13 releases

  3. Fixed

    7.18.2 – 7.18.4

    3 releases

228 stable releases of react-router, oldest to newest, one row per major.

Is your project affected?

Paste your package.json, or type the range you declare for react-router. It is read in your browser and sent nowhere.

What happens

This is a follow up to CVE-2026-22030 to address related CSRF flows in unstable RSC code paths.

[!NOTE] This only affects your application if you are using the unstable RSC APIs