Aller au contenu
en Se connecter
3.1 Faible

CVE-2026-53663 React Router is a router for React

Description

React Router is a router for React. From 7.12.0 until 7.15.1, certain CSRF checks in React Router v7 Framework Mode were insufficient and run on POST requests, but were bypassed on PUT/PATCH/DELETE requests. This is a low severity vulnerability because modern browser protections (CORS preflight, SameSite cookies) already block the cross-origin attack vectors that this missing CSRF check would otherwise gate. This vulnerability is fixed in 7.15.1.

Produits et versions touchés

Produit Versions touchées Corrigé en
react-router 7.12 7.12.0 → < 7.15.1 7.15.1
server-runtime 2.17 2.17.3 → < 2.17.5 2.17.5

Références

Chronologie

  1. Publiée
  2. Dernière modification

Autres CVE de react-router

Les 21 CVE de react-router →
CVE-2026-53669 React Router is a router for React 5.1 Moyenne CVE-2026-55685 React Router is a router for React 8.7 Élevée CVE-2026-53668 React Router is a router for React 6.9 Moyenne CVE-2026-53667 React Router is a router for React 6.9 Moyenne
Suivre cette CVE