[GHSA-qwww-vcr4-c8h2] React Router: RSC Mode CSRF Bypass Allows Action Execution Before 400 Response

[georgevgs]

Updates

• Affected products
• References

Comments
The affected range collapses two disjoint intervals into their union. The source advisory at /repos/remix-run/react-router/security-advisories lists two products: >= 7.12.0, < 7.18.2 patched at 7.18.2, and >= 8.0.0, < 8.3.0 patched at 8.3.0. Its updated_at equals published_at (2026-07-22), so this was its shape at publication.

The v7 fix is PR #15353, "Harden RSC CSRF codepaths (backport of #15311)", whose commit message states "Backports the fix for GHSA-qwww-vcr4-c8h2 to v7". Merged 2026-07-28 20:52Z, released in 7.18.2 at 21:53Z. The current record's references cite only v8 material.

As it stands, npm audit reports 7.18.2 as vulnerable and npm audit fix --force proposes downgrading to 7.11.0, which moves users away from the fix.

[github]

Hi there @brophdawg11! A community member has suggested an improvement to your security advisory. If approved, this change will affect the global advisory listed at github.com/advisories. It will not affect the version listed in your project repository.

This change will be reviewed by our Security Curation Team. If you have thoughts or feedback, please share them in a comment here! If this PR has already been closed, you can start a new community contribution for this advisory

[brophdawg11]

dup of #8868