React Router: Potential CSRF via PUT/PATCH/DELETE document requests

Description

Certain CSRF checks in React Router v7 Framework Mode were insufficient and run on POST requests, but were bypassed on PUT/PATCH/DELETE requests.

Recommendation

Update the @remix-run/server-runtime package to the latest compatible version. Followings are version details:

• Affected version(s): >= 2.17.3, < 2.17.5
• Patched version(s): 2.17.5

References

• GHSA-84g9-w2xq-vcv6
• CVE-2026-53663
• CWE-352
• CAPEC-310
• OWASP 2021-A1
• OWASP 2021-A6

Related Issues

• React Router vulnerable to DoS via unbounded path expansion in __manifest endpoint - CVE-2026-42342
• React Router has CSRF issue in Action/Server Action Request Processing - CVE-2026-22030
• RedwoodSDK has a CSRF vulnerability in server function dispatch via GET requests - CVE-2026-39371
• React Router vulnerable to Denial of Service via reflected user input in single-fetch - CVE-2026-34077

You might also like:

CSRF, XXE, and 12 Other Security Acronyms Explained

How to Secure your NodeJs Express Javascript Application - part 1

Update Cheat Sheet for Developers

Tags:

npm

@remix-run/server-runtime