CVSS 3.1
3.1 lowCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:NCVE-2026-53663
Low (3.1). EPSS 0.1% chance of exploitation in the next 30 days. Fixed in react-router 7.15.1.
React Router is a router for React. From 7.12.0 until 7.15.1, certain CSRF checks in React Router v7 Framework Mode were insufficient and run on POST requests, but were bypassed on PUT/PATCH/DELETE requests. This is a low severity vulnerability because modern browser protections (CORS preflight, SameSite cookies) already block the cross-origin attack vectors that this missing CSRF check would otherwise gate. This vulnerability is fixed in 7.15.1.
Severity
- EPSS
- 0.1% chance of exploitation in the next 30 days; higher than 3% of CVEs (scores of 2026-10-31)
- CWE
- CWE-352
- Published
- Modified
- Record from
- the NVD, synced
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-84g9-w2xq-vcv6 | npm | react-router | >=7.12.0 <7.15.1 | 7.15.1 |
| GHSA-84g9-w2xq-vcv6 | npm | @remix-run/server-runtime | >=2.17.3 <2.17.5 | 2.17.5 |