PT-2026-2138 · Unknown · @Remix-Run/Server-Runtime+1

Oceandust · Published 2026-01-08 · Updated 2026-01-30 · CVE-2026-22030

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions react-router versions 7.0.0 through 7.11.0 @remix-run/server-runtime versions prior to 2.17.3

Description React Router, used as a router for React applications, is susceptible to Cross-Site Request Forgery (CSRF) attacks. This affects document POST requests to UI routes when server-side route action handlers are used in Framework Mode, or when utilizing React Server Actions in unstable Rendering Server Components (RSC) modes. The issue does not impact applications using Declarative Mode () or Data Mode (createBrowserRouter/). The issue occurs when processing requests to UI routes with server-side action handlers.

Recommendations Update @remix-run/server-runtime to version 2.17.3 or later. Update react-router to version 7.12.0 or later.

Exploit

Fix

Origin Validation Error

CSRF

Weakness Enumeration

CWE-346

CWE-352

Related Identifiers

CVE-2026-22030

GHSA-H5CW-625J-3RXH

Affected Products

@Remix-Run/Server-Runtime

React Router

References · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/22xxx/CVE-2026-22030.json · Exploit
• https://github.com/remix-run/react-router/security/advisories/GHSA-h5cw-625j-3rxh · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-h5cw-625j-3rxh · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-22030 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-22030 · Security Note
• https://github.com/remix-run/react-router · Note
• https://twitter.com/CVEnew/status/2009837429453205858 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2009915356144455950 · Twitter Post
• https://twitter.com/Progosling/status/2017089341168771163 · Twitter Post