CVEDB API

Vulnerabilities

Vulnerable Software

Vulnerability Details CVE-2026-22030

React Router is a router for React. In @remix-run/server-runtime version prior to 2.17.3. and react-router 7.0.0 through 7.11.0, React Router (or Remix v2) is vulnerable to CSRF attacks on document POST requests to UI routes when using server-side route action handlers in Framework Mode, or when using React Server Actions in the new unstable RSC modes. There is no impact if Declarative Mode (<BrowserRouter>) or Data Mode (createBrowserRouter/<RouterProvider>) is being used. This issue has been patched in @remix-run/server-runtime version 2.17.3 and react-router version 7.12.0.

Exploit prediction scoring system (EPSS) score

EPSS Score 0.0

EPSS Ranking 5.4%

CVSS Severity

CVSS v3 Score 6.5

References

https://github.com/remix-run/react-router/security/advisories/GHSA-h5cw-625j-3rxh

Products affected by CVE-2026-22030

Shopify » React-Router » Version: 7.0.0

cpe:2.3:a:shopify:react-router:7.0.0
Shopify » React-Router » Version: 7.0.1

cpe:2.3:a:shopify:react-router:7.0.1
Shopify » React-Router » Version: 7.0.2

cpe:2.3:a:shopify:react-router:7.0.2
Shopify » React-Router » Version: 7.1.0

cpe:2.3:a:shopify:react-router:7.1.0
Shopify » React-Router » Version: 7.1.1

cpe:2.3:a:shopify:react-router:7.1.1
Shopify » React-Router » Version: 7.1.2

cpe:2.3:a:shopify:react-router:7.1.2
Shopify » React-Router » Version: 7.1.3

cpe:2.3:a:shopify:react-router:7.1.3
Shopify » React-Router » Version: 7.1.4

cpe:2.3:a:shopify:react-router:7.1.4
Shopify » React-Router » Version: 7.1.5

cpe:2.3:a:shopify:react-router:7.1.5
Shopify » React-Router » Version: 7.10.0

cpe:2.3:a:shopify:react-router:7.10.0
Shopify » React-Router » Version: 7.10.1

cpe:2.3:a:shopify:react-router:7.10.1
Shopify » React-Router » Version: 7.11.0

cpe:2.3:a:shopify:react-router:7.11.0
Shopify » React-Router » Version: 7.2.0

cpe:2.3:a:shopify:react-router:7.2.0
Shopify » React-Router » Version: 7.3.0

cpe:2.3:a:shopify:react-router:7.3.0
Shopify » React-Router » Version: 7.4.0

cpe:2.3:a:shopify:react-router:7.4.0
Shopify » React-Router » Version: 7.4.1

cpe:2.3:a:shopify:react-router:7.4.1
Shopify » React-Router » Version: 7.5.0

cpe:2.3:a:shopify:react-router:7.5.0
Shopify » React-Router » Version: 7.5.1

cpe:2.3:a:shopify:react-router:7.5.1
Shopify » React-Router » Version: 7.5.2

cpe:2.3:a:shopify:react-router:7.5.2
Shopify » React-Router » Version: 7.5.3

cpe:2.3:a:shopify:react-router:7.5.3
Shopify » React-Router » Version: 7.6.0

cpe:2.3:a:shopify:react-router:7.6.0
Shopify » React-Router » Version: 7.6.1

cpe:2.3:a:shopify:react-router:7.6.1
Shopify » React-Router » Version: 7.6.2

cpe:2.3:a:shopify:react-router:7.6.2
Shopify » React-Router » Version: 7.6.3

cpe:2.3:a:shopify:react-router:7.6.3
Shopify » React-Router » Version: 7.7.0

cpe:2.3:a:shopify:react-router:7.7.0
Shopify » React-Router » Version: 7.7.1

cpe:2.3:a:shopify:react-router:7.7.1
Shopify » React-Router » Version: 7.8.0

cpe:2.3:a:shopify:react-router:7.8.0
Shopify » React-Router » Version: 7.8.1

cpe:2.3:a:shopify:react-router:7.8.1
Shopify » React-Router » Version: 7.8.2

cpe:2.3:a:shopify:react-router:7.8.2
Shopify » React-Router » Version: 7.9.0

cpe:2.3:a:shopify:react-router:7.9.0
Shopify » React-Router » Version: 7.9.1

cpe:2.3:a:shopify:react-router:7.9.1
Shopify » React-Router » Version: 7.9.2

cpe:2.3:a:shopify:react-router:7.9.2
Shopify » React-Router » Version: 7.9.3

cpe:2.3:a:shopify:react-router:7.9.3
Shopify » React-Router » Version: 7.9.4

cpe:2.3:a:shopify:react-router:7.9.4
Shopify » React-Router » Version: 7.9.5

cpe:2.3:a:shopify:react-router:7.9.5
Shopify » React-Router » Version: 7.9.6

cpe:2.3:a:shopify:react-router:7.9.6
Shopify » Remix-Run/react » Version: 1.15.0

cpe:2.3:a:shopify:remix-run/react:1.15.0
Shopify » Remix-Run/react » Version: 1.23.2

cpe:2.3:a:shopify:remix-run/react:1.23.2
Shopify » Remix-Run/react » Version: 2.17.0

cpe:2.3:a:shopify:remix-run/react:2.17.0

Vulnerabilities

Vulnerable Software

Vulnerability Details CVE-2026-22030

Products

Pricing

Contact Us