Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
3 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
Certain CSRF checks in React Router v7 Framework Mode were insufficient and run on POST requests, but were bypassed on PUT/PATCH/DELETE requests. This is a low severity vulnerability because modern browser protections (CORS preflight, SameSite cookies) already block the cross-origin attack vectors that this missing CSRF check would otherwise gate. [!NOTE] This does not impact your React Router application if you are using Declarative Mode (<BrowserRouter) or Data Mode (createBrowserRouter/<RouterProvider).
Recommended action: Upgrade to 2.17.5 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
There exists a potential DOS attack vector in React Router Framework Mode applications (as well as Remix v2.10.0 - 2.17.4). Certain requests can be crafted to consume disproportionate resources on the server, resulting in response time degredation and/or service unavailability for end users. [!NOTE] This does not impact your React Router application if you are using Declarative Mode (<BrowserRouter) or Data Mode (createBrowserRouter/<RouterProvider).
Recommended action: Upgrade to 2.17.5 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
React Router (or Remix v2) is vulnerable to CSRF attacks on document POST requests to UI routes when using server-side route action handlers in Framework Mode, or when using React Server Actions in the new unstable RSC modes. [!NOTE] This does not impact your application if you are using Declarative Mode (<BrowserRouter) or Data Mode (createBrowserRouter/<RouterProvider).
Recommended action: Upgrade to 2.17.3 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.