Skip to content
OpenAdvisories

Package · npm

@remix-run/server-runtime

3 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

3 results · Feed

  • Low 3.1
    CVE-2026-53663

    React Router: `handleDocumentRequest` CSRF check covers `POST` only; PUT/PATCH/DELETE bypass

    React Router is a router for React. From 7.12.0 until 7.15.1, certain CSRF checks in React Router v7 Framework Mode were insufficient and run on POST requests, but were bypassed on PUT/PATCH/DELETE requests. This is a low severity vulnerability because modern…

    remix-run react-router server-runtime vitess-24 Wolfi npm
  • High 7.5
    CVE-2026-42342

    React Router vulnerable to DoS via unbounded path expansion in __manifest endpoint

    React Router is a router for React. In versions 7.0.0 through 7.14.x of react-router and versions 2.10.0 through 2.17.4 of @remix-run/server-runtime, certain crafted requests can consume disproportionate server resources via unbounded path expansion in the __…

    remix-run react-router @remix-run/server-runtime vitess-24 Wolfi npm
  • Medium 6.5
    CVE-2026-22030

    React Router has CSRF issue in Action/Server Action Request Processing

    React Router is a router for React. In @remix-run/server-runtime version prior to 2.17.3. and react-router 7.0.0 through 7.11.0, React Router (or Remix v2) is vulnerable to CSRF attacks on document POST requests to UI routes when using server-side route actio…

    remix-run react-router react-router @remix-run/server-runtime npm