[GHSA-qwww-vcr4-c8h2] React Router: RSC Mode CSRF Bypass Allows Action Execution Before 400 Response

[ryanthemanuel]

Updates

• Affected products

Comments
The affected range for the 7.x line is too broad — it should end at 7.18.2, not 8.3.0.

The fix (remix-run/react-router#15311, released in 8.3.0) was backported to the v7 branch as remix-run/react-router#15353, "Backport RSC CSRF hardening to v7", and released in react-router@7.18.2 on 2026-07-28 — four days after this record was created.

The advisory published by the maintainers in remix-run/react-router already reflects this as two separate ranges:

= 7.12.0, < 7.18.2 — patched >= 7.18.2
= 8.0.0, < 8.3.0 — patched >= 8.3.0
This record still has them merged into a single >= 7.12.0, < 8.3.0 with first-patched 8.3.0, and has not been modified since it was published on 2026-07-24. The effect is that every consumer on the latest 7.x is flagged with no in-major upgrade path: react-router-dom does not exist past 7.x, so "upgrade to 8.3.0" reads as a required major migration rather than a patch bump.

Requested change: split into the two ranges above, matching the upstream advisory.

References:

Backport PR: remix-run/react-router#15353
v7 changelog: https://github.com/remix-run/react-router/blob/v7/CHANGELOG.md#v7182 — "react-router - Harden RSC CSRF codepaths"
Original fix: remix-run/react-router#15311

[github]

Hi there @brophdawg11! A community member has suggested an improvement to your security advisory. If approved, this change will affect the global advisory listed at github.com/advisories. It will not affect the version listed in your project repository.

This change will be reviewed by our Security Curation Team. If you have thoughts or feedback, please share them in a comment here! If this PR has already been closed, you can start a new community contribution for this advisory

[ryanthemanuel]

I'm not sure I was able to get the syntax, but the affected products should be >= 7.12.0, < 7.18.2 or >=8.0.0, < 8.3.0

[Copilot]

Pull request overview

Updates React Router advisory GHSA-qwww-vcr4-c8h2 to model separate affected 7.x and 8.x ranges.

Changes:

• Adds the 7.18.2 patched version.
• Adds affected-version fallback metadata.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[ollwenjones]

This is affecting us as well (currently on 6.x). We'd rather upgrade to React 19 on a less emergency basis to clear the vulnerabilities.