React Router is a router for React. In @remix-run/server-runtime version prior to 2.17.3. and react-router 7.0.0 through 7.11.0, React Router (or Remix v2) is vulnerable to CSRF attacks on document POST requests to UI routes when using server-side route action handlers in Framework Mode, or when using React Server Actions in the new unstable RSC modes. There is no impact if Declarative Mode (<BrowserRouter>) or Data Mode (createBrowserRouter/<RouterProvider>) is being used. This issue has been patched in @remix-run/server-runtime version 2.17.3 and react-router version 7.12.0.
References
| Link | Resource |
|---|---|
| https://github.com/remix-run/react-router/security/advisories/GHSA-h5cw-625j-3rxh | Vendor Advisory |
Configurations
Configuration 1 (hide)
|
History
05 Feb 2026, 20:51
| Type | Values Removed | Values Added |
|---|---|---|
| CPE | cpe:2.3:a:shopify:react-router:*:*:*:*:*:node.js:*:* cpe:2.3:a:shopify:remix-run\/react:*:*:*:*:*:node.js:*:* |
|
| First Time |
Shopify
Shopify react-router Shopify remix-run\/react |
|
| References | () https://github.com/remix-run/react-router/security/advisories/GHSA-h5cw-625j-3rxh - Vendor Advisory |
10 Jan 2026, 03:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2026-01-10 03:15
Updated : 2026-02-05 20:51
NVD link : CVE-2026-22030
Mitre link : CVE-2026-22030
CVE.ORG link : CVE-2026-22030
JSON object : View
Products Affected
shopify
- remix-run\/react
- react-router