React-Router (>= 7.12.0, < 8.3.0) - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/react-router--7.12.0--8.3.0/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioFri, 24 Jul 2026 16:51:35 +0000React Router RSC Mode CSRF Bypasshttps://feed.craftedsignal.io/briefs/2026-07-react-router-csrf-bypass/Fri, 24 Jul 2026 16:51:35 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-07-react-router-csrf-bypass/A high-severity Cross-Site Request Forgery (CSRF) bypass vulnerability in React Router's unstable React Server Components (RSC) APIs allows for action execution before a 400 response, impacting applications utilizing these specific APIs.A Cross-Site Request Forgery (CSRF) bypass vulnerability, identified as GHSA-qwww-vcr4-c8h2, has been discovered in specific versions of the React Router library (npm/react-router). This flaw, affecting versions greater than or equal to 7.12.0 and less than 8.3.0, specifically impacts applications that utilize the unstable React Server Components (RSC) APIs. This is a follow-up to a previously addressed related CSRF flow (CVE-2026-22030). An attacker can leverage this vulnerability to execute unauthorized actions within the context of an authenticated user's session. The issue allows these actions to be performed even before an expected 400 response would typically halt such attempts. Organizations using React Router with RSC APIs are at risk, as successful exploitation could lead to unauthorized data modification or other integrity compromises.

Impact

Successful exploitation of the React Router CSRF bypass vulnerability leads to a high integrity impact on affected applications. Attackers can trick authenticated users into performing unintended actions within the application. This could result in unauthorized data manipulation, configuration changes, or other actions that compromise the trustworthiness and veracity of information managed by the vulnerable system. While the advisory does not specify observed victims or targeted sectors, any web application using the affected React Router versions with unstable RSC APIs is susceptible to this integrity compromise.

Recommendation

  • Immediately upgrade npm/react-router to version 8.3.0 or later, as referenced in the GitHub advisory GHSA-qwww-vcr4-c8h2, to remediate the Cross-Site Request Forgery (CSRF) bypass vulnerability.
  • Review applications utilizing React Router's unstable RSC APIs to understand potential exposure and verify successful patching.
]]>mediumadvisoryreactroutercsrfweb-applicationvulnerability