Security readout for executives and security teams
Plain-English summary
CVE-2026-22030 is a cross-site request forgery issue in React Router and Remix configurations that process document POST requests with server-side action handlers. An attacker could trick a signed-in user into submitting an unintended request, potentially changing application data. The issue is patched in @remix-run/server-runtime 2.17.3 and react-router 7.12.0.
Executive priority
Treat as a medium-priority web application integrity risk. Prioritize internet-facing applications where authenticated users can perform sensitive state-changing actions. Patch during the next standard security update cycle, faster for high-value applications using affected modes.
Technical view
The vulnerability affects React Router Framework Mode route action handlers and unstable RSC React Server Actions. It impacts @remix-run/server-runtime versions before 2.17.3 and react-router 7.0.0 through 7.11.0. Declarative Mode using BrowserRouter and Data Mode using createBrowserRouter/RouterProvider are stated as not impacted. CVSS is 6.5, with high integrity impact.
Likely exposure
Exposure is likely for web applications using affected React Router or Remix versions with Framework Mode server-side route actions, or unstable RSC server actions. Applications using only Declarative Mode or Data Mode are not exposed according to the advisory.
Exploitation context
The source describes a CSRF scenario requiring user interaction: a victim must be induced to submit a document POST request while authenticated. No active exploitation is reported in the provided sources, and the CVE is not listed as KEV in the provided bundle.
Researcher notes
The provided evidence is limited to the CVE record and GitHub advisory. Key exposure hinges on routing mode and server action usage, not just package presence. Avoid assuming all React Router deployments are vulnerable; the advisory explicitly excludes Declarative Mode and Data Mode usage.
Mitigation direction
- Upgrade @remix-run/server-runtime to 2.17.3 or later where applicable.
- Upgrade react-router to 7.12.0 or later where applicable.
- Check the GitHub advisory for project-specific upgrade guidance.
- Prioritize applications using server-side route actions or unstable RSC server actions.
Validation and detection
- Inventory applications using react-router or @remix-run/server-runtime.
- Confirm installed versions against the affected ranges.
- Identify whether Framework Mode route actions are used.
- Identify whether unstable RSC React Server Actions are used.
- Confirm Declarative Mode or Data Mode-only applications are not misclassified as exposed.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-346: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCWE-352: User-session and phishing behavior lookup
Client-side and session-facing weaknesses should be reviewed alongside initial-access and user-execution behaviors. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2026-22030 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 6.5 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N2.83.6Primary CVE scoreVulnerability scoring details
Base CVSS 3.1 score
6.5MediumVector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
Source materials
- CVE List V5 sourceCVE List V5
- https://github.com/remix-run/react-router/security/advisories/GHSA-h5cw-625j-3rxhCVE reference · x_refsource_CONFIRM
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Origin Validation Error
Origin Validation Error represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.
Cross-Site Request Forgery (CSRF)
Cross-Site Request Forgery (CSRF) represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.