GHSA-qwww-vcr4-c8h2 React Router: RSC Mode CSRF Bypass Allows Action Execution Before 400 Response
Attackers can bypass CSRF protections in unstable RSC mode to execute actions before a 400 response, affecting applications using these experimental APIs.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is GHSA-qwww-vcr4-c8h2?
GHSA-qwww-vcr4-c8h2 is a vulnerability in react-router, published on 24 Jul 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
This is a follow up to CVE-2026-22030 to address related CSRF flows in unstable RSC code paths.
> [!NOTE] > This only affects your application if you are using the unstable RSC APIs
Which versions are affected by GHSA-qwww-vcr4-c8h2?
4 open source packages ship an affected version, including react-router.
| Package | Affected | Fixed in |
|---|---|---|
react-router npm | From 7.12.0 | 7.18.2 |
react-router npm | From 7.12.0 | 7.18.2 |
react-router npm | From 8.0.0 | 8.3.0 |
react-router npm | From 8.0.0 | 8.3.0 |
How do I fix GHSA-qwww-vcr4-c8h2?
Upgrade react-router to a fixed version for your release line: 7.18.2 or 8.3.0.
Is GHSA-qwww-vcr4-c8h2 being exploited?
There is no known exploitation of GHSA-qwww-vcr4-c8h2 in the wild and no public exploit code.