Description
Certain CSRF checks in React Router v7 Framework Mode were insufficient and run on POST requests, but were bypassed on PUT/PATCH/DELETE requests.
Recommendation
Update the @remix-run/server-runtime package to the latest compatible version. Followings are version details:
- Affected version(s): >= 2.17.3, < 2.17.5
- Patched version(s): 2.17.5
References
Could your website be exposed too?
SmartScanner can check your website for React Router: Potential CSRF via PUT/PATCH/DELETE document requests and gives you actionable findings to investigate.
Start a free scanRelated Issues
- React Router vulnerable to DoS via unbounded path expansion in __manifest endpoint - CVE-2026-42342
- React Router has CSRF issue in Action/Server Action Request Processing - CVE-2026-22030
- RedwoodSDK has a CSRF vulnerability in server function dispatch via GET requests - CVE-2026-39371
- React Router vulnerable to Denial of Service via reflected user input in single-fetch - CVE-2026-34077
You might also like:
See something that needs correcting? Let us knowUpdated June 15, 2026