[GHSA-qwww-vcr4-c8h2] React Router: RSC Mode CSRF Bypass Allows Action Execution Before 400 Response

[georgevgs]

Updates

• Affected products
• References

Comments
The affected range collapses two disjoint intervals into their union. The source advisory at /repos/remix-run/react-router/security-advisories lists two products: >= 7.12.0, < 7.18.2 patched at 7.18.2, and >= 8.0.0, < 8.3.0 patched at 8.3.0. Its updated_at equals published_at (2026-07-22), so this was its shape at publication.

The v7 fix is PR #15353, "Harden RSC CSRF codepaths (backport of #15311)", whose commit message states "Backports the fix for GHSA-qwww-vcr4-c8h2 to v7". Merged 2026-07-28 20:52Z, released in 7.18.2 at 21:53Z. The current record's references cite only v8 material.

As it stands, npm audit reports 7.18.2 as vulnerable and npm audit fix --force proposes downgrading to 7.11.0, which moves users away from the fix.

[github]

Hi there @brophdawg11! A community member has suggested an improvement to your security advisory. If approved, this change will affect the global advisory listed at github.com/advisories. It will not affect the version listed in your project repository.

This change will be reviewed by our Security Curation Team. If you have thoughts or feedback, please share them in a comment here! If this PR has already been closed, you can start a new community contribution for this advisory

[brophdawg11]

dup of #8868

[advisory-database]

Hi @georgevgs! Thank you so much for contributing to the GitHub Advisory Database. This database is free, open, and accessible to all, and it's people like you who make it great. Thanks for choosing to help others. We hope you send in more contributions in the future!