GHSA-qwww-vcr4-c8h2: React Router: RSC Mode CSRF Bypass Allows Action Execution Before 400 Response
(updated )
This is a follow up to CVE-2026-22030 to address related CSRF flows in unstable RSC code paths.
[!NOTE] This only affects your application if you are using the unstable RSC APIs
References
- github.com/advisories/GHSA-qwww-vcr4-c8h2
- github.com/remix-run/react-router/blob/main/CHANGELOG.md
- github.com/remix-run/react-router/blob/v7/CHANGELOG.md
- github.com/remix-run/react-router/commit/7a71c728ad116bd78699a258b2014ce9585729f5
- github.com/remix-run/react-router/commit/8ebd5df9932854547963e3255c8454e62430e05d
- github.com/remix-run/react-router/pull/15353
- github.com/remix-run/react-router/releases/tag/react-router%407.18.2
- github.com/remix-run/react-router/releases/tag/react-router@8.3.0
- github.com/remix-run/react-router/security/advisories/GHSA-qwww-vcr4-c8h2
Code Behaviors & Features
Detect and mitigate GHSA-qwww-vcr4-c8h2 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →