CVE-2026-53663: React Router CSRF Bypass in PUT/PATCH/DELETE (Low Severity)

Technical summary

React Router Framework Mode implements CSRF token validation as a security control against unauthorized state-changing operations. Between versions 7.12.0 and 7.15.0, the CSRF middleware inconsistently applied this check—validating POST requests but bypassing validation for PUT, PATCH, and DELETE operations. An attacker could theoretically craft a cross-origin request using one of these HTTP methods to perform unauthorized actions on behalf of an authenticated user, but only if the target application neither enforces CORS preflight validation nor sets appropriate SameSite cookie attributes. Since modern browsers enforce these defenses by default, the vulnerability requires an unusual security configuration to exploit. The fix in 7.15.1 ensures consistent CSRF token validation across all state-modifying HTTP methods.

Business impact

Applications using React Router Framework Mode between 7.12.0 and 7.15.0 have a CSRF control gap that is largely mitigated by browser defaults. The practical business risk is low unless an application explicitly disables CORS enforcement or sets permissive SameSite cookie policies. Organizations should prioritize upgrading, but this is not an emergency-level patch. The low CVSS score (3.1) reflects the presence of compensating controls in modern browsers. Any application with non-standard security configurations (permissive CORS, legacy SameSite handling) should treat this with higher urgency.

Affected systems

React Router versions 7.12.0, 7.12.1, 7.13.0, 7.14.0, and 7.15.0 are affected. Any application built on these versions and deployed in production requires a patch. Older major versions (6.x and below) and the patched 7.15.1 release are not vulnerable. The exact scope depends on your inventory of React Router usage across your application portfolio.

Exploitability

Exploitation requires a user to be authenticated to the vulnerable React Router application and to visit a malicious cross-origin site while maintaining an active session. The attacker would need to craft a PUT, PATCH, or DELETE request to the target application. However, this attack is blocked in practice by CORS preflight checks (which require the target to explicitly allow cross-origin requests) and SameSite cookie defaults (which prevent cookies from being sent cross-origin in modern browsers). An application would need unusual security settings—such as very permissive CORS policies or legacy SameSite=None without Secure flag—for the vulnerability to be exploitable. No public exploit code or in-the-wild attacks have been reported.

Remediation

Upgrade React Router to version 7.15.1 or later as soon as feasible. This is a straightforward dependency update in most projects using npm, yarn, or pnpm. Test the upgrade in a staging environment to verify compatibility with your routing configuration and middleware stack. No code changes should be necessary; the patch applies consistent CSRF validation across all HTTP methods transparently.

Patch guidance

Update React Router to 7.15.1 or any subsequent release. In npm-based projects, run `npm update react-router@latest` or `npm install [email protected]`. Verify the version change in package-lock.json or package.json. Rebuild and redeploy your application. If you use monorepo tooling or custom dependency resolution, ensure all internal references to React Router are updated to the patched version. No rollback is necessary; the patch is backward-compatible at the API level.

Detection guidance

Check your application's dependencies using `npm list react-router` or equivalent tool to identify which versions are installed. During code review or CI/CD scanning, ensure that package.json or equivalent does not pin React Router to 7.12.0–7.15.0. If you use software composition analysis (SCA) tools or SBOM generation, those systems should flag this CVE automatically once metadata is updated. Application-level detection is unnecessary; the vulnerability exists in the framework, not in custom code.

Why prioritize this

Although the CVSS score is low (3.1), this vulnerability should still be addressed in your normal patch cadence because (1) it is a direct framework control bypass, (2) an upgrade path is available and low-risk, and (3) delayed patching increases the window for a security researcher or attacker to develop working exploits that circumvent browser mitigations. However, this is not an emergency patch; organizations can batch it with other routine updates and test it in standard staging workflows. Critical or production-facing applications should prioritize it over less-critical dependencies.

Risk score, explained

The CVSS 3.1 score of 3.1 (LOW severity) reflects a low impact scope: no confidentiality or availability risk, minimal integrity risk (only if other security controls are also weakened). The attack complexity is high (AC:H) because modern browsers block the attack by default. User interaction is required (a victim must visit the malicious site). The attack vector is network-based but practically very constrained by browser policy. The low score is justified by the presence of compensating controls (CORS, SameSite) that must fail in unison for exploitation to succeed.

Frequently asked questions