CVE-2026-53663 React Router: `handleDocumentRequest` CSRF check covers `POST` only; PUT/PATCH/DELETE bypass
React Router's CSRF protection fails for PUT, PATCH, and DELETE requests, allowing potential cross-site request forgery bypasses in Framework Mode.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-53663?
CVE-2026-53663 is a low-severity vulnerability in @remix-run react-router, published on 22 Jun 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
React Router is a router for React. From 7.12.0 until 7.15.1, certain CSRF checks in React Router v7 Framework Mode were insufficient and run on POST requests, but were bypassed on PUT/PATCH/DELETE requests. This is a low severity vulnerability because modern browser protections (CORS preflight, SameSite cookies) already block the cross-origin attack vectors that this missing CSRF check would otherwise gate. This vulnerability is fixed in 7.15.1.
Weakness: CWE-352
Which versions are affected by CVE-2026-53663?
4 open source packages ship an affected version, including @remix-run/server-runtime and react-router.
| Package | Affected | Fixed in |
|---|---|---|
@remix-run/server-runtime npm | From 2.17.3 | 2.17.5 |
@remix-run/server-runtime npm | From 2.17.3 | 2.17.5 |
react-router npm | From 7.12.0 | 7.15.1 |
react-router npm | From 7.12.0 | 7.15.1 |
Linux distribution packages (1)
agama-web-ui openSUSE:Tumbleweed | All versions | 23+0.f26ed5eab-49.1 |
How do I fix CVE-2026-53663?
Upgrade @remix-run/server-runtime to 2.17.5 or later.
Is CVE-2026-53663 being exploited?
There is no known exploitation of CVE-2026-53663 in the wild and no public exploit code.
Sources
Also known as CLSA-2026-1793120008, GHSA-84g9-w2xq-vcv6, MINI-fjrw-pf76-547w, ROOT-APP-NPM-CVE-2026-53663, openSUSE-SU-2026:11325-1.