{"id":"CVE-2026-53663","aliases":["GHSA-84g9-w2xq-vcv6"],"title":"React Router: Potential CSRF via PUT/PATCH/DELETE document requests","summary":"React Router: Potential CSRF via PUT/PATCH/DELETE document requests","severity":"low","cvss":3.1,"cwe":["CWE-352"],"vendor":"react-router","product":"react-router","ecosystem":"npm","affected":["react-router >= 7.12.0, < 7.15.1","@remix-run/server-runtime >= 2.17.3, < 2.17.5"],"patched":["react-router 7.15.1","@remix-run/server-runtime 2.17.5"],"published":"2026-06-15","updated":"2026-06-15","source":"GHSA","sourceUrl":"https://github.com/advisories/GHSA-84g9-w2xq-vcv6","references":[{"url":"https://github.com/remix-run/react-router/security/advisories/GHSA-84g9-w2xq-vcv6"},{"url":"https://github.com/advisories/GHSA-84g9-w2xq-vcv6"}],"tags":["ghsa","npm"],"epss":0.00148,"epssPercentile":0.04376,"ingestedAt":"2026-07-07T15:41:58.697Z","slug":"CVE-2026-53663","body":"## Overview\n\nCertain CSRF checks in React Router v7 [Framework Mode]() were insufficient and run on POST requests, but were bypassed on PUT/PATCH/DELETE requests.  This is a low severity vulnerability because modern browser protections (CORS preflight, SameSite cookies) already block the cross-origin attack vectors that this missing CSRF check would otherwise gate.\n\n> [!NOTE]\n> This does not impact your React Router application if you are using [Declarative Mode](https://reactrouter.com/start/modes#framework) (`<BrowserRouter>`) or [Data Mode](https://reactrouter.com/start/modes#data) (`createBrowserRouter`/`<RouterProvider>`).\n\n## Affected packages\n\n- `react-router >= 7.12.0, < 7.15.1`\n- `@remix-run/server-runtime >= 2.17.3, < 2.17.5`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `react-router 7.15.1`\n- `@remix-run/server-runtime 2.17.5`","depth":"sunlit","depthScore":17,"depthScoreParts":{"impact":17.1,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}