React Router: RSC Mode CSRF Bypass Allows Action Execution Before 400 Response
A high-severity Cross-Site Request Forgery (CSRF) vulnerability affects React Router's unstable React Server Components (RSC) APIs. This flaw allows action execution before a 400 response is returned, potentially bypassing CSRF protections. The issue is a follow-up to CVE-2026-22030 and only impacts applications using the unstable RSC APIs. A patch is available to address this vulnerability.
AI Analysis
Technical Summary
This vulnerability in React Router involves a CSRF bypass in the unstable React Server Components (RSC) code paths, allowing actions to be executed before a 400 HTTP response is returned. It is related to CVE-2026-22030 and specifically affects versions >=7.12.0 <7.18.2 and >=8.0.0 <8.3.0. The vulnerability is classified under CWE-352 (Cross-Site Request Forgery) and has a CVSS 4.0 vector indicating network attack vector, low attack complexity, no privileges required, user interaction required, and high impact on integrity. The vulnerability only affects applications using the unstable RSC APIs. A patch is available to remediate this issue.
Potential Impact
Successful exploitation could allow an attacker to bypass CSRF protections and execute unauthorized actions within affected React Router applications that use the unstable RSC APIs. This could lead to unauthorized state changes or operations before the server returns a 400 error response. No known exploits in the wild have been reported.
Mitigation Recommendations
A patch is available for this vulnerability. Users of React Router who utilize the unstable RSC APIs should update to versions 7.18.2 or later and 8.3.0 or later to mitigate this issue. Applications not using the unstable RSC APIs are not affected. No additional mitigation steps are indicated by the vendor advisory.
React Router: RSC Mode CSRF Bypass Allows Action Execution Before 400 Response
Description
A high-severity Cross-Site Request Forgery (CSRF) vulnerability affects React Router's unstable React Server Components (RSC) APIs. This flaw allows action execution before a 400 response is returned, potentially bypassing CSRF protections. The issue is a follow-up to CVE-2026-22030 and only impacts applications using the unstable RSC APIs. A patch is available to address this vulnerability.
CVSS v4.0
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
This vulnerability in React Router involves a CSRF bypass in the unstable React Server Components (RSC) code paths, allowing actions to be executed before a 400 HTTP response is returned. It is related to CVE-2026-22030 and specifically affects versions >=7.12.0 <7.18.2 and >=8.0.0 <8.3.0. The vulnerability is classified under CWE-352 (Cross-Site Request Forgery) and has a CVSS 4.0 vector indicating network attack vector, low attack complexity, no privileges required, user interaction required, and high impact on integrity. The vulnerability only affects applications using the unstable RSC APIs. A patch is available to remediate this issue.
Potential Impact
Successful exploitation could allow an attacker to bypass CSRF protections and execute unauthorized actions within affected React Router applications that use the unstable RSC APIs. This could lead to unauthorized state changes or operations before the server returns a 400 error response. No known exploits in the wild have been reported.
Mitigation Recommendations
A patch is available for this vulnerability. Users of React Router who utilize the unstable RSC APIs should update to versions 7.18.2 or later and 8.3.0 or later to mitigate this issue. Applications not using the unstable RSC APIs are not affected. No additional mitigation steps are indicated by the vendor advisory.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-qwww-vcr4-c8h2
- Osv Schema Version
- 1.4.0
- Aliases
- []
- Ecosystems
- ["npm"]
- Database Specific Severity
- HIGH
- Cvss Version
- 4.0
Threat ID: 6a774326bf8831d539b45ae8
Added to database: 08/08/2026, 14:54:30 UTC
Last enriched: 08/08/2026, 15:36:46 UTC
Last updated: 08/08/2026, 18:05:44 UTC
Views: 4
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.