CVE-2026-53663: React Router: `handleDocumentRequest` CSRF check covers `POST` only; PUT/PATCH/DELETE bypass
Certain CSRF checks in React Router v7 Framework Mode were insufficient and run on POST requests, but were bypassed on PUT/PATCH/DELETE requests. This is a low severity vulnerability because modern browser protections (CORS preflight, SameSite cookies) already block the cross-origin attack vectors that this missing CSRF check would otherwise gate.
[!NOTE] This does not impact your React Router application if you are using Declarative Mode (<BrowserRouter>) or Data Mode (createBrowserRouter/<RouterProvider>).
Other sources
React Router is a router for React. From 7.12.0 until 7.15.1, certain CSRF checks in React Router v7 Framework Mode were insufficient and run on POST requests, but were bypassed on PUT/PATCH/DELETE requests. This is a low severity vulnerability because modern browser protections (CORS preflight, SameSite cookies) already block the cross-origin attack vectors that this missing CSRF check would otherwise gate. This vulnerability is fixed in 7.15.1.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
npm/@remix-run/server-runtimeto a version that resolves this vulnerability.Fixed in 2.17.5 - Upgrade
Upgrade
npm/react-routerto a version that resolves this vulnerability.Fixed in 7.15.1 - Upgrade
Upgrade
React Routerto a version that resolves this vulnerability.Fixed in 7.15.1
Event History
Frequently Asked Questions
What is the severity of CVE-2026-53663?
CVE-2026-53663 has a severity rating of low (3.1).
What types of requests are affected by CVE-2026-53663?
CVE-2026-53663 affects PUT, PATCH, and DELETE requests due to insufficient CSRF checks.
How do I fix CVE-2026-53663?
To fix CVE-2026-53663, ensure that CSRF checks are implemented for all HTTP methods, including PUT, PATCH, and DELETE.
What software is impacted by CVE-2026-53663?
CVE-2026-53663 impacts npm/@remix-run/server-runtime and npm/react-router.
Why is CVE-2026-53663 considered a low severity vulnerability?
CVE-2026-53663 is considered low severity because modern browser protections like CORS preflight and SameSite cookies mitigate the risk of exploitation.