[GHSA-qwww-vcr4-c8h2] React Router: RSC Mode CSRF Bypass Allows Action Execution Before 400 Response

[ryanthemanuel]

Updates

• Affected products

Comments
The affected range for the 7.x line is too broad — it should end at 7.18.2, not 8.3.0.

The fix (remix-run/react-router#15311, released in 8.3.0) was backported to the v7 branch as remix-run/react-router#15353, "Backport RSC CSRF hardening to v7", and released in react-router@7.18.2 on 2026-07-28 — four days after this record was created.

The advisory published by the maintainers in remix-run/react-router already reflects this as two separate ranges:

= 7.12.0, < 7.18.2 — patched >= 7.18.2
= 8.0.0, < 8.3.0 — patched >= 8.3.0
This record still has them merged into a single >= 7.12.0, < 8.3.0 with first-patched 8.3.0, and has not been modified since it was published on 2026-07-24. The effect is that every consumer on the latest 7.x is flagged with no in-major upgrade path: react-router-dom does not exist past 7.x, so "upgrade to 8.3.0" reads as a required major migration rather than a patch bump.

Requested change: split into the two ranges above, matching the upstream advisory.

References:

Backport PR: remix-run/react-router#15353
v7 changelog: https://github.com/remix-run/react-router/blob/v7/CHANGELOG.md#v7182 — "react-router - Harden RSC CSRF codepaths"
Original fix: remix-run/react-router#15311

[github]

Hi there @brophdawg11! A community member has suggested an improvement to your security advisory. If approved, this change will affect the global advisory listed at github.com/advisories. It will not affect the version listed in your project repository.

This change will be reviewed by our Security Curation Team. If you have thoughts or feedback, please share them in a comment here! If this PR has already been closed, you can start a new community contribution for this advisory

[ryanthemanuel]

I'm not sure I was able to get the syntax, but the affected products should be >= 7.12.0, < 7.18.2 or >=8.0.0, < 8.3.0

[Copilot]

Pull request overview

Updates React Router advisory GHSA-qwww-vcr4-c8h2 to model separate affected 7.x and 8.x ranges.

Changes:

• Adds the 7.18.2 patched version.
• Adds affected-version fallback metadata.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[ollwenjones]

This is affecting us as well (currently on 6.x). We'd rather upgrade to React 19 on a less emergency basis to clear the vulnerabilities.

[ollwenjones]

looks like copilot is suggesting the right fixes here @ryanthemanuel. Any chacne this can land soon?

[brophdawg11]

dup of #8868

[advisory-database]

Hi @ryanthemanuel! Thank you so much for contributing to the GitHub Advisory Database. This database is free, open, and accessible to all, and it's people like you who make it great. Thanks for choosing to help others. We hope you send in more contributions in the future!