---
id: CVE-2026-53663
aliases:
  - GHSA-84g9-w2xq-vcv6
title: 'React Router: Potential CSRF via PUT/PATCH/DELETE document requests'
summary: 'React Router: Potential CSRF via PUT/PATCH/DELETE document requests'
severity: low
cvss: 3.1
cwe:
  - CWE-352
vendor: react-router
product: react-router
ecosystem: npm
affected:
  - 'react-router >= 7.12.0, < 7.15.1'
  - '@remix-run/server-runtime >= 2.17.3, < 2.17.5'
patched:
  - react-router 7.15.1
  - '@remix-run/server-runtime 2.17.5'
published: '2026-06-15'
updated: '2026-06-15'
source: GHSA
sourceUrl: 'https://github.com/advisories/GHSA-84g9-w2xq-vcv6'
references:
  - url: >-
      https://github.com/remix-run/react-router/security/advisories/GHSA-84g9-w2xq-vcv6
  - url: 'https://github.com/advisories/GHSA-84g9-w2xq-vcv6'
tags:
  - ghsa
  - npm
epss: 0.00148
epssPercentile: 0.04371
ingestedAt: '2026-07-07T15:41:58.697Z'
---

## Overview

Certain CSRF checks in React Router v7 [Framework Mode]() were insufficient and run on POST requests, but were bypassed on PUT/PATCH/DELETE requests.  This is a low severity vulnerability because modern browser protections (CORS preflight, SameSite cookies) already block the cross-origin attack vectors that this missing CSRF check would otherwise gate.

> [!NOTE]
> This does not impact your React Router application if you are using [Declarative Mode](https://reactrouter.com/start/modes#framework) (`<BrowserRouter>`) or [Data Mode](https://reactrouter.com/start/modes#data) (`createBrowserRouter`/`<RouterProvider>`).

## Affected packages

- `react-router >= 7.12.0, < 7.15.1`
- `@remix-run/server-runtime >= 2.17.3, < 2.17.5`

## Remediation

Upgrade to a patched release:

- `react-router 7.15.1`
- `@remix-run/server-runtime 2.17.5`