highJul 24, 2026

react-router RSC Mode CSRF Bypass ()

Shubham Kandhare
Security Engagement Manager, SecureLayer7

A gap in React Router's unstable RSC request handling lets a malicious page trigger authenticated server actions on a victim's behalf, bypassing the origin check that was supposed to block cross-site…

Packagereact-router
Ecosystemnpm
Affected>= 7.12.0, < 8.3.0
Fixed in8.3.0
react-router RSC Mode CSRF Bypass (GHSA-qwww-vcr4-c8h2)

The problem

React Router added a throwIfPotentialCSRFAttack guard in v7.12.0 (CVE-2026-22030) to block cross-origin POST requests to Framework Mode action handlers. The guard compared the request Origin header against the server's own host.

The RSC-specific code paths (versions 7.12.0 through 8.2.x) did not apply this same guard. A cross-origin POST to an RSC action endpoint was processed and the action executed before the server eventually returned a 400. An attacker could exploit any authenticated server action this way.

Proof of concept

A working proof-of-concept for this issue in react-router, with the exact payload below.

http
<!-- attacker-controlled page at https://evil.example -->
<html>
<body>
<form id="x" method="POST" action="https://victim.app/some-rsc-action-route">
  <input name="transfer_to" value="attacker" />
  <input name="amount" value="9999" />
</form>
<script>document.getElementById('x').submit();</script>
</body>
</html>

The original CVE-2026-22030 fix wired throwIfPotentialCSRFAttack into handleDocumentRequest for standard server-rendered routes, but the parallel RSC request handler (unstable_routeRSCServerRequest and related paths) branched off before that check ran. Because the action logic executed before the 400 response was sent, the server-side mutation completed even though the response indicated failure.

PR #15311 (commit 7a71c728) hardened these RSC code paths by applying the same origin-validation guard that already existed for non-RSC routes. The root cause is CWE-352: missing CSRF origin check in a newly added code branch.

The fix

Upgrade react-router to **8.3.0** or later. This only affects applications using the unstable RSC APIs. If an immediate upgrade is not possible, disable the unstable RSC features or add an explicit Origin / Referer check in a server middleware layer in front of all action routes.

Reported by Remix / React Router security team.

References: [1][2][3][4][5][6]

Related research