@remix-run/server-runtime
2.17.5 · 1 Jun 2026MIT502.9k / weekRepositoryHomepagenpmAtom feed
Security advisories
From OSV, open ones first. Each release line gets its own fix: an older major is fixed by a patch on that major, not by moving to the newest one.
Is your project affected?
Paste your package.json, or type the range you declare for @remix-run/server-runtime. It is read in your browser and sent nowhere.
| Line | Newest | Where it stands |
|---|---|---|
| 2.17.5 | Safe from 2.17.5 | |
| 1.19.3 | 2 open advisories, worst moderate · last release Aug 2023, no longer updated |
- HighReact Router vulnerable to DoS via unbounded path expansion in __manifest endpointGHSA-8x6r-g9mw-2r78 · 3 Jun 2026
- 2.x2.10.0 – 2.17.4Fixed in 2.17.5
- ModerateReact Router has CSRF issue in Action/Server Action Request ProcessingGHSA-h5cw-625j-3rxh · 8 Jan 2026
- 2.x2.0.0 – 2.17.2Fixed in 2.17.3
- 1.x and older0.21.0 – 1.19.3No fix, no longer updated · move to 2.17.3
- LowReact Router: Potential CSRF via PUT/PATCH/DELETE document requestsGHSA-84g9-w2xq-vcv6 · 15 Jun 2026
- 2.x2.17.3 – 2.17.4Fixed in 2.17.5
Registry facts last checked 23 Oct 2026. Releases and advisories last read 23 Oct 2026.