React Router v7 Framework Mode versions 7.12.0 through 7.15.0 have incomplete CSRF protections: CSRF checks are performed on POST requests but are bypassed on PUT, PATCH, and DELETE requests. This weakness could allow cross-site request forgery attacks on these HTTP methods. However, modern browser security features like CORS preflight requests and SameSite cookie attributes reduce the risk of exploitation. The vulnerability is addressed in React Router version 7.15.1.

The vulnerability could allow an attacker to perform unauthorized state-changing requests (PUT, PATCH, DELETE) via CSRF if browser protections are bypassed or misconfigured. However, the impact is limited because modern browsers enforce CORS preflight and SameSite cookie policies that block most cross-origin CSRF attempts. No confidentiality or availability impacts are reported.

Upgrade React Router to version 7.15.1 or later where this CSRF protection issue is fixed. Until then, rely on modern browser protections such as CORS preflight and SameSite cookies to mitigate risk. No additional vendor advisory or patch information is provided, so check the official remix-run repository or release notes for updates.