React Router v7 Framework Mode CSRF Bypass via PUT/PATCH/DELETE (GHSA-84g9-w2xq-vcv6)

github.com 2026-06-27查看中文 →

Security AdvisoryGHSA-84g9-w2xq-vcv6Lowremix-run/react-router

Affected:

@remix-run/server-runtime >=2.17.3 <2.17.5
react-router >=7.12.0 <7.15.1

Fixed in:

@remix-run/server-runtime >=2.17.5
react-router >=7.15.1

Referenced CVEs: CVE-2026-53663 · 3.1

文章内图片已隐藏以节省流量 · Upgrade to Pro to view images & offline archive

This content was auto-fetched from github.com, cleaned by our LLM pipeline, and translated to English. View original.

More from this source

FlaskBB <=2.2.0 Auth Bypass/IDOR via forged Topic IDs 2026-07-10 FlaskBB Fix: Added Permission Check to Prevent Deletion of Standard Groups 2026-07-10 Plug Cookie Attribute Injection (CVE-2025-5613) 2026-07-10 Plug Cookie Semicolon Injection Fix 2026-07-10 Plug Multipart Length Limit Bypass DoS Vulnerability (CVE-2025-5814) 2026-07-10

Offline Archive

Offline screenshot & PDF are Pro-exclusive