A high-severity Cross-Site Request Forgery (CSRF) vulnerability affects React Router's unstable React Server Components (RSC) APIs. This flaw allows action execution before a 400 response is returned, potentially bypassing CSRF protections. The issue is a follow-up to CVE-2026-22030 and only impacts applications using the unstable RSC APIs. A patch is available to address this vulnerability.