CVE-2026-53663: @remix-Run Server-Runtime

Low severity, CVSS 3.1. EPSS: 0.1% chance of exploitation in the next 30 days.

React Router is a router for React. From 7.12.0 until 7.15.1, certain CSRF checks in React Router v7 Framework Mode were insufficient and run on POST requests, but were bypassed on PUT/PATCH/DELETE requests. This is a low severity vulnerability because modern browser protections (CORS preflight, SameSite cookies) already block the cross-origin attack vectors that this missing CSRF check would otherwise gate. This vulnerability is fixed in 7.15.1.

Affected products

• @remix-Run Server-Runtime: from 2.17.3, before 2.17.5 (fixed in 2.17.5)
• Remix-Run React-Router: from 7.12.0, before 7.15.1 (fixed in 7.15.1)

Published 2026-06-22. Last modified 2026-06-23.