Read the docs
TI-2026-67138 Aliases GHSA-qwww-vcr4-c8h2

React Router: RSC Mode CSRF Bypass Allows Action Execution Before 400 Response

Priority LOW 38CWE-352Published · Updated

Key facts

Attack vector
—
Privileges required
—
User interaction
—
Attack complexity
—
Impact type
Tampering
Confidentiality · integrity · availability
—
Fix status
Fixed

No CVSS vector from any source. Fix status from GitHub. Impact type from CWE-352.

Summary

This is a follow up to CVE-2026-22030 to address related CSRF flows in unstable RSC code paths. > [!NOTE] > This only affects your application if you are using the unstable RSC APIs

Why it matters now

Fix Fixed react-router (npm): 7.18.2, 8.3.0

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
—react-router (npm)7.12.0 to before 7.18.27.18.2Patch availableGHSA-qwww-vcr4-c8h2
—react-router (npm)8.0.0 to before 8.3.08.3.0Patch availableGHSA-qwww-vcr4-c8h2
  • react-router (npm) Vendor— Affected 7.12.0 to before 7.18.2 Fixed in 7.18.2 Patch available GHSA-qwww-vcr4-c8h2
  • react-router (npm) Vendor— Affected 8.0.0 to before 8.3.0 Fixed in 8.3.0 Patch available GHSA-qwww-vcr4-c8h2

Remediation

  • Fix · GHSA-qwww-vcr4-c8h2 react-router (npm) Fixed in 7.18.2 Advisory →
  • Fix · GHSA-qwww-vcr4-c8h2 react-router (npm) Fixed in 8.3.0 Advisory →

Timeline

  1. 2026-10-03 Threatist record created from GHSA-qwww-vcr4-c8h2

References

Other 10

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences