code · pull · Jan 23, 2026 · Jan 6, 2026 · Jan 7, 2026 · Jan 7, 2026
diff --git a/CHANGELOG.md b/CHANGELOG.md
diff --git a/contributors.yml b/contributors.yml
@@ -27,6 +27,7 @@
 - amitdahan
 - AmRo045
 - amsal
+- AnandShiva
 - Andarist
 - andreasottosson-polestar
 - andreiborza

diff --git a/docs/api/components/Links.md b/docs/api/components/Links.md
@@ -45,7 +45,7 @@ export default function Root() {
 ## Signature
 
 ```tsx
-function Links({ nonce }: LinksProps): React.JSX.Element
+function Links({ nonce, crossOrigin }: LinksProps): React.JSX.Element
 ```
 
 ## Props
@@ -56,3 +56,9 @@ A [`nonce`](https://developer.mozilla.org/en-US/docs/Web/HTML/Reference/Global_a
 attribute to render on the [`<link>`](https://developer.mozilla.org/en-US/docs/Web/HTML/Element/link)
 element
 
+### crossOrigin
+
+A [`crossOrigin`](https://developer.mozilla.org/en-US/docs/Web/HTML/Attributes/crossorigin)
+attribute to render on the [`<link>`](https://developer.mozilla.org/en-US/docs/Web/HTML/Element/link)
+element
+
diff --git a/docs/api/framework-conventions/react-router.config.ts.md b/docs/api/framework-conventions/react-router.config.ts.md
@@ -30,6 +30,45 @@ export default {
 
 ## Options
 
+### `allowedActionOrigins`
+
+An array of allowed origin hosts for action submissions to UI routes (does not apply to resource routes). Supports micromatch glob patterns (`*` to match one segment, `**` to match multiple).
+
+```tsx filename=react-router.config.ts
+export default {
+  allowedActionOrigins: [
+    "example.com",
+    "*.example.com", // sub.example.com
+    "**.example.com", // sub.domain.example.com
+  ],
+} satisfies Config;
+```
+
+If you need to set this value at runtime, you can do in by setting the value on the server build in your custom server. For example, when using `express`:
+
+```ts
+import express from "express";
+import { createRequestHandler } from "@react-router/express";
+import type { ServerBuild } from "react-router";
+
+export const app = express();
+
+async function getBuild() {
+  let build: ServerBuild = await import(
+    "virtual:react-router/server-build"
+  );
+  return {
+    ...build,
+    allowedActionOrigins:
+      process.env.NODE_ENV === "development"
+        ? undefined
+        : ["staging.example.com", "www.example.com"],
+  };
+}
+
+app.use(createRequestHandler({ build: getBuild }));
+```
+
 ### `appDirectory`
 
 The path to the `app` directory, relative to the root directory. Defaults to `"app"`.
@@ -66,7 +105,11 @@ A function that is called after the full React Router build is complete.
 
 ```tsx filename=react-router.config.ts
 export default {
-  buildEnd: async ({ buildManifest, reactRouterConfig, viteConfig }) => {
+  buildEnd: async ({
+    buildManifest,
+    reactRouterConfig,
+    viteConfig,
+  }) => {
     // Custom build logic here
     console.log("Build completed!");
   },

diff --git a/docs/api/rsc/matchRSCServerRequest.md b/docs/api/rsc/matchRSCServerRequest.md
@@ -70,6 +70,7 @@ matchRSCServerRequest({
 
 ```tsx
 async function matchRSCServerRequest({
+  allowedActionOrigins,
   createTemporaryReferenceSet,
   basename,
   decodeReply,
@@ -82,6 +83,7 @@ async function matchRSCServerRequest({
   routes,
   generateResponse,
 }: {
+  allowedActionOrigins?: string[];
   createTemporaryReferenceSet: () => unknown;
   basename?: string;
   decodeReply?: DecodeReplyFunction;
@@ -107,6 +109,10 @@ async function matchRSCServerRequest({
 
 ## Params
 
+### opts.allowedActionOrigins
+
+Origin patterns that are allowed to execute actions.
+
 ### opts.basename
 
 The basename to use when matching the request.

diff --git a/packages/create-react-router/CHANGELOG.md b/packages/create-react-router/CHANGELOG.md
@@ -1,7 +1,13 @@
 # `create-react-router`
 
+## 7.13.0
+
+_No changes_
+
 ## 7.12.0
 
+_No changes_
+
 ## 7.11.0
 
 _No changes_

diff --git a/packages/create-react-router/package.json b/packages/create-react-router/package.json
@@ -1,6 +1,6 @@
 {
   "name": "create-react-router",
-  "version": "7.12.0",
+  "version": "7.13.0",
   "description": "Create a new React Router app",
   "homepage": "https://reactrouter.com",
   "bugs": {

diff --git a/packages/react-router-architect/CHANGELOG.md b/packages/react-router-architect/CHANGELOG.md
@@ -1,5 +1,13 @@
 # `@react-router/architect`
 
+## 7.13.0
+
+### Patch Changes
+
+- Updated dependencies:
+  - `react-router@7.13.0`
+  - `@react-router/node@7.13.0`
+
 ## 7.12.0
 
 ### Patch Changes

diff --git a/packages/react-router-architect/package.json b/packages/react-router-architect/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@react-router/architect",
-  "version": "7.12.0",
+  "version": "7.13.0",
   "description": "Architect server request handler for React Router",
   "bugs": {
     "url": "https://github.com/remix-run/react-router/issues"

diff --git a/packages/react-router-cloudflare/CHANGELOG.md b/packages/react-router-cloudflare/CHANGELOG.md
@@ -1,5 +1,12 @@
 # `@react-router/cloudflare`
 
+## 7.13.0
+
+### Patch Changes
+
+- Updated dependencies:
+  - `react-router@7.13.0`
+
 ## 7.12.0
 
 ### Patch Changes

diff --git a/packages/react-router-cloudflare/package.json b/packages/react-router-cloudflare/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@react-router/cloudflare",
-  "version": "7.12.0",
+  "version": "7.13.0",
   "description": "Cloudflare platform abstractions for React Router",
   "bugs": {
     "url": "https://github.com/remix-run/react-router/issues"

diff --git a/packages/react-router-dev/CHANGELOG.md b/packages/react-router-dev/CHANGELOG.md
@@ -1,5 +1,15 @@
 # `@react-router/dev`
 
+## 7.13.0
+
+### Patch Changes
+
+- Bump @remix-run/node-fetch-server dep ([#14704](https://github.com/remix-run/react-router/pull/14704))
+- Updated dependencies:
+  - `react-router@7.13.0`
+  - `@react-router/node@7.13.0`
+  - `@react-router/serve@7.13.0`
+
 ## 7.12.0
 
 ### Minor Changes

diff --git a/packages/react-router-dev/config/config.ts b/packages/react-router-dev/config/config.ts
@@ -213,8 +213,44 @@ export type ReactRouterConfig = {
   ssr?: boolean;
 
   /**
-   * The allowed origins for actions / mutations. Does not apply to routes
-   * without a component. micromatch glob patterns are supported.
+   * An array of allowed origin hosts for action submissions to UI routes (does not apply
+   * to resource routes). Supports micromatch glob patterns (`*` to match one segment,
+   * `**` to match multiple).
+   *
+   * ```tsx
+   * export default {
+   *   allowedActionOrigins: [
+   *     "example.com",
+   *     "*.example.com", // sub.example.com
+   *     "**.example.com", // sub.domain.example.com
+   *   ],
+   * } satisfies Config;
+   * ```
+   *
+   * If you need to set this value at runtime, you can do in by setting the value
+   * on the server build in your custom server. For example, when using `express`:
+   *
+   * ```ts
+   * import express from "express";
+   * import { createRequestHandler } from "@react-router/express";
+   * import type { ServerBuild } from "react-router";
+   *
+   * export const app = express();
+   *
+   * async function getBuild() {
+   *   let build: ServerBuild = await import(
+   *     "virtual:react-router/server-build"
+   *   );
+   *   return {
+   *     ...build,
+   *     allowedActionOrigins:
+   *       process.env.NODE_ENV === "development"
+   *         ? undefined
+   *         : ["staging.example.com", "www.example.com"],
+   *   };
+   * }
+   *
+   * app.use(createRequestHandler({ build: getBuild }));
    */
   allowedActionOrigins?: string[];
 };

diff --git a/packages/react-router-dev/package.json b/packages/react-router-dev/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@react-router/dev",
-  "version": "7.12.0",
+  "version": "7.13.0",
   "description": "Dev tools and CLI for React Router",
   "homepage": "https://reactrouter.com",
   "bugs": {
@@ -77,7 +77,7 @@
     "@babel/traverse": "^7.27.7",
     "@babel/types": "^7.27.7",
     "@react-router/node": "workspace:*",
-    "@remix-run/node-fetch-server": "^0.9.0",
+    "@remix-run/node-fetch-server": "^0.13.0",
     "arg": "^5.0.1",
     "babel-dead-code-elimination": "^1.0.6",
     "chokidar": "^4.0.0",

diff --git a/packages/react-router-dev/vite/cloudflare-dev-proxy.ts b/packages/react-router-dev/vite/cloudflare-dev-proxy.ts
@@ -1,4 +1,3 @@
-import { sendResponse } from "@remix-run/node-fetch-server";
 import { createRequestHandler } from "react-router";
 import {
   type AppLoadContext,
@@ -121,6 +120,9 @@ export const cloudflareDevProxyVitePlugin = <Env, Cf extends CfProperties>(
       }
     },
     configureServer: async (viteDevServer) => {
+      // Async import here to allow ESM only module on Node 20.18.
+      // TODO(v8): Can move to a normal import when Node 20 support
+      const { sendResponse } = await import("@remix-run/node-fetch-server");
       let context: Awaited<ReturnType<typeof getContext>>;
       let getContext = async () => {
         let { getPlatformProxy } = await importWrangler();
@@ -139,7 +141,7 @@ export const cloudflareDevProxyVitePlugin = <Env, Cf extends CfProperties>(
               )) as ServerBuild;
 
               let handler = createRequestHandler(build, "development");
-              let req = fromNodeRequest(nodeReq, nodeRes);
+              let req = await fromNodeRequest(nodeReq, nodeRes);
               context ??= await getContext();
               let loadContext = getLoadContext
                 ? await getLoadContext({ request: req, context })

diff --git a/packages/react-router-dev/vite/node-adapter.ts b/packages/react-router-dev/vite/node-adapter.ts
@@ -1,25 +1,26 @@
 import type { ServerResponse } from "node:http";
 
-import { createRequest } from "@remix-run/node-fetch-server";
 import type * as Vite from "vite";
-
 import invariant from "../invariant";
 
 export type NodeRequestHandler = (
   req: Vite.Connect.IncomingMessage,
   res: ServerResponse,
 ) => Promise<void>;
 
-export function fromNodeRequest(
+export async function fromNodeRequest(
   nodeReq: Vite.Connect.IncomingMessage,
   nodeRes: ServerResponse<Vite.Connect.IncomingMessage>,
-): Request {
+): Promise<Request> {
   // Use `req.originalUrl` so React Router is aware of the full path
   invariant(
     nodeReq.originalUrl,
     "Expected `nodeReq.originalUrl` to be defined",
   );
   nodeReq.url = nodeReq.originalUrl;
 
+  // Async import here to allow ESM only module on Node 20.18.
+  // TODO(v8): Can move to a normal import when Node 20 support
+  const { createRequest } = await import("@remix-run/node-fetch-server");
   return createRequest(nodeReq, nodeRes);
 }
diff --git a/packages/react-router-dev/vite/plugin.ts b/packages/react-router-dev/vite/plugin.ts
@@ -15,7 +15,6 @@ import {
 import * as path from "node:path";
 import * as url from "node:url";
 import * as babel from "@babel/core";
-import { sendResponse } from "@remix-run/node-fetch-server";
 import {
   unstable_setDevServerHooks as setDevServerHooks,
   createRequestHandler,
@@ -1673,11 +1672,16 @@ export const reactRouterVitePlugin: ReactRouterVitePlugin = () => {
                   nodeReq,
                   nodeRes,
                 ) => {
-                  let req = fromNodeRequest(nodeReq, nodeRes);
+                  let req = await fromNodeRequest(nodeReq, nodeRes);
                   let res = await handler(
                     req,
                     await reactRouterDevLoadContext(req),
                   );
+                  // Async import here to allow ESM only module on Node 20.18.
+                  // TODO(v8): Can move to a normal import when Node 20 support
+                  const { sendResponse } = await import(
+                    "@remix-run/node-fetch-server"
+                  );
                   await sendResponse(nodeRes, res);
                 };
                 await nodeHandler(req, res);
@@ -1717,11 +1721,17 @@ export const reactRouterVitePlugin: ReactRouterVitePlugin = () => {
                 nodeReq,
                 nodeRes,
               ) => {
-                let req = fromNodeRequest(nodeReq, nodeRes);
+                let req = await fromNodeRequest(nodeReq, nodeRes);
                 let res = await handler(
                   req,
                   await reactRouterDevLoadContext(req),
                 );
+
+                // Async import here to allow ESM only module on Node 20.18.
+                // TODO(v8): Can move to a normal import when Node 20 support
+                const { sendResponse } = await import(
+                  "@remix-run/node-fetch-server"
+                );
                 await sendResponse(nodeRes, res);
               };
               await nodeHandler(req, res);

diff --git a/packages/react-router-dom/CHANGELOG.md b/packages/react-router-dom/CHANGELOG.md
@@ -1,5 +1,12 @@
 # react-router-dom
 
+## 7.13.0
+
+### Patch Changes
+
+- Updated dependencies:
+  - `react-router@7.13.0`
+
 ## 7.12.0
 
 ### Patch Changes

diff --git a/packages/react-router-dom/package.json b/packages/react-router-dom/package.json
@@ -1,6 +1,6 @@
 {
   "name": "react-router-dom",
-  "version": "7.12.0",
+  "version": "7.13.0",
   "description": "Declarative routing for React web applications",
   "keywords": [
     "react",

diff --git a/packages/react-router-express/CHANGELOG.md b/packages/react-router-express/CHANGELOG.md
@@ -1,5 +1,13 @@
 # `@react-router/express`
 
+## 7.13.0
+
+### Patch Changes
+
+- Updated dependencies:
+  - `react-router@7.13.0`
+  - `@react-router/node@7.13.0`
+
 ## 7.12.0
 
 ### Patch Changes