CVE-2026-53663

A flaw was found in React Router. Insufficient Cross-Site Request Forgery (CSRF) checks in the framework mode allow a remote attacker to bypass these protections on PUT, PATCH, and DELETE requests. This could lead to a low integrity impact, where an attacker might be able to perform unintended actions on behalf of a user. Modern browser security features, such as Cross-Origin Resource Sharing (CORS) preflight and SameSite cookies, significantly limit the practical exploitability of this vulnerability.

This is a Low impact vulnerability. Insufficient Cross-Site Request Forgery (CSRF) checks in React Router's framework mode could allow an attacker to bypass protections on PUT, PATCH, and DELETE requests. However, modern browser security features like CORS preflight and SameSite cookies significantly reduce the practical exploitability of this flaw in typical Red Hat deployments.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Red Hat products that ship react-router are affected by this CSRF bypass in Framework Mode on PUT, PATCH, and DELETE requests. However, modern browser protections — CORS preflight checks and SameSite cookie defaults — significantly limit the practical exploitability of this flaw.

No specific workaround is required. Updating to react-router 7.15.1 or later, when available in product updates, will fully resolve this issue.