RSC Mode CSRF Bypass Allows Action Execution Before 400 Response

Moderate

brophdawg11 published GHSA-qwww-vcr4-c8h2

Jul 22, 2026

Package

react-router (npm)

Affected versions

>= 7.12.0, < 7.18.2

>= 8.0.0, < 8.3.0

Patched versions

7.18.2

8.3.0

Description

This is a follow up to CVE-2026-22030 to address related CSRF flows in unstable RSC code paths.

Note

This only affects your application if you are using the unstable RSC APIs