What is the CVSS score of CVE-2026-22030?

CVE-2026-22030 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N. EPSS exploitation probability: 0.0%.

Which versions of React are affected by CVE-2026-22030?

Organizations using React Router should be aware of notable risk from CVE-2026-22030 rated CVSS 6.5. Exploitation could compromise the security of affected deployments.. A patch is available.

How to fix or mitigate CVE-2026-22030?

Within 30 days: Identify affected systems and apply vendor patches as part of regular patch cycle. Monitor vendor channels for patch availability.

React CVE-2026-22030

MEDIUM

Origin Validation Error (CWE-346)

2026-01-10 security-advisories@github.com

GHSA-h5cw-625j-3rxh

React CSRF React Router Red Hat Suse

6.5

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

SUSE

MEDIUM

qualitative

Red Hat

6.5 MEDIUM

qualitative

Primary rating from GitHub Advisory.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

None

Lifecycle Timeline

Patch released

Mar 31, 2026 - 21:13 nvd

Patch available

Analysis Generated

Mar 12, 2026 - 21:54 vuln.today

CVE Published

Jan 10, 2026 - 03:15 nvd

MEDIUM 6.5

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

11 npm packages depend on @remix-run/server-runtime (5 direct, 6 indirect)
6 npm packages depend on react-router (3 direct, 3 indirect)

Ecosystem-wide dependent count for version 2.17.3 and other introduced versions.

DescriptionGitHub Advisory

React Router is a router for React. In @remix-run/server-runtime version prior to 2.17.3. and react-router 7.0.0 through 7.11.0, React Router (or Remix v2) is vulnerable to CSRF attacks on document POST requests to UI routes when using server-side route action handlers in Framework Mode, or when using React Server Actions in the new unstable RSC modes. There is no impact if Declarative Mode (<BrowserRouter>) or Data Mode (createBrowserRouter/<RouterProvider>) is being used. This issue has been patched in @remix-run/server-runtime version 2.17.3 and react-router version 7.12.0.

AnalysisAI

React Router is a router for React. In @remix-run/server-runtime version prior to 2.17.3. [CVSS 6.5 MEDIUM]

Technical ContextAI

Classified as CWE-346 (Origin Validation Error). Affects React-Router. React Router is a router for React. In @remix-run/server-runtime version prior to 2.17.3. and react-router 7.0.0 through 7.11.0, React Router (or Remix v2) is vulnerable to CSRF attacks on document POST requests to UI routes when using server-side route action handlers in Framework Mode, or when using React Server Actions in the new unstable RSC modes. There is no impact if Declarative Mode (<BrowserRouter>) or Data Mode (createBrowserRouter/<RouterProvider>) is being used. This issue has been p

RemediationAI

Monitor vendor advisories for a patch. Restrict network access to the affected service where possible.

More in React

View all

CVE-2025-55182 CRITICAL Act Now POC

10.0 Dec 03

React Server Components in React 19.x contain a critical pre-authentication remote code execution vulnerability (CVE-202

CVE-2025-45001 HIGH This Week POC

7.5 Jun 09

react-native-keys version 0.7.11 contains a sensitive information disclosure vulnerability where encryption ciphers and

CVE-2026-22028 MEDIUM This Month POC

6.1 Jan 08

HTML injection in Preact and React through unsafe JSON deserialization allows remote attackers to inject arbitrary scrip

CVE-2026-27612 MEDIUM This Month POC

6.1 Feb 25

Reflected XSS in Repostat's RepoCard React component prior to version 1.0.1 allows attackers to execute arbitrary JavaSc

CVE-2026-23864 HIGH This Week

7.5 Jan 26

Uncontrolled resource consumption in React Server Components (react-server-dom-parcel, react-server-dom-turbopack, react

CVE-2026-1461 MEDIUM This Month

6.5 Feb 19

Simple Membership (WordPress plugin) versions up to 4.7.0 contains a security vulnerability (CVSS 6.5).

CVE-2025-68470 MEDIUM This Month

6.5 Jan 10

React-Router versions up to 6.30.1 is affected by url redirection to untrusted site (open redirect) (CVSS 6.5).

CVE-2026-30847 MEDIUM This Month

6.5 Mar 06

Wekan is an open source kanban tool built with Meteor. [CVSS 6.5 MEDIUM]

CVE-2018-6341 MEDIUM This Month

6.1 Dec 31

React applications which rendered to HTML using the ReactDOMServer API were not escaping user-supplied attribute names a

CVE-2026-29613 MEDIUM This Month

5.9 Mar 05

Openclaw versions up to 2026.2.12 is affected by missing authentication for critical function (CVSS 5.9).

CVE-2025-14969 MEDIUM This Month

4.3 Jan 26

A flaw was found in Hibernate Reactive. When an HTTP endpoint is exposed to perform database operations, a remote client

CVE-2026-28194 MEDIUM This Month

4.3 Feb 25

Teamcity versions up to 2025.11.3 is affected by url redirection to untrusted site (open redirect) (CVSS 4.3).

Same weakness CWE-346 – Origin Validation Error

View all

CVE-2015-4495 HIGH POC

8.8

CVE-2025-34291 CRITICAL POC

9.4

CVE-2020-16952 HIGH POC

8.6

CVE-2022-50925 CRITICAL POC

9.8

CVE-2024-25124 CRITICAL POC

9.8

CVE-2023-29711 CRITICAL POC

9.8

CVE-2023-33443 CRITICAL POC

9.8

CVE-2023-29728 CRITICAL POC

9.8

Same technique CSRF

View all

CVE-2016-6277 HIGH POC

8.8

CVE-2014-100005 HIGH POC

8.0

CVE-2017-9757 HIGH POC

8.8

CVE-2013-5696 MEDIUM POC

6.8

CVE-2013-4152 MEDIUM POC

6.8

CVE-2024-7094 CRITICAL

9.8

CVE-2015-4624 HIGH POC

7.5

CVE-2020-36836 HIGH POC

8.0

Vendor StatusVendor

SUSE

Severity: Medium

Product	Status
SUSE Linux Enterprise Module for Package Hub 15 SP7	Fixed
SUSE Linux Enterprise Module for SAP Applications 15 SP7	Fixed
SUSE Linux Enterprise Server 16.0	Fixed
SUSE Linux Enterprise Server 16.0	Fixed
SUSE Linux Enterprise Server 16.1	Fixed

CVE-2026-22030 vulnerability details – vuln.today

Back

SUSE Linux Enterprise Server for SAP Applications 15 SP7	Fixed
SUSE Linux Enterprise Server for SAP applications 16.0	Fixed
SUSE Linux Enterprise Server for SAP applications 16.0	Fixed
SUSE Linux Enterprise Server for SAP applications 16.0	Fixed
SUSE Linux Enterprise Server for SAP applications 16.1	Fixed
SUSE Linux Enterprise Server for SAP applications 16.1	Fixed
SUSE Manager Client Tools 15	Fixed
SUSE Manager Client Tools for SLE 12	Fixed
SUSE Manager Client Tools for SLE 15	Fixed
SUSE Multi-Linux Manager Client Tools for SLE 12	Fixed
SUSE Multi-Linux Manager Client Tools for SLE 15	Fixed
openSUSE Leap 15.6	Fixed
SUSE Linux Enterprise Server for SAP Applications 15 SP6	Fixed
SUSE Manager Proxy LTS 4.3	Fixed
SUSE Manager Proxy Module 4.3	Fixed
SUSE Enterprise Storage 6	Fixed
SUSE Linux Enterprise Module for Package Hub 15 SP5	Fixed
SUSE Linux Enterprise Module for Package Hub 15 SP6	Fixed
SUSE Linux Enterprise Module for SAP Applications 15 SP3	Fixed
SUSE Linux Enterprise Module for SAP Applications 15 SP4	Fixed
SUSE Linux Enterprise Module for SAP Applications 15 SP5	Fixed
SUSE Linux Enterprise Module for SAP Applications 15 SP6	Fixed
SUSE Linux Enterprise Server for SAP Applications 15 SP3	Fixed
SUSE Linux Enterprise Server for SAP Applications 15 SP4	Fixed
SUSE Linux Enterprise Server for SAP Applications 15 SP5	Fixed
SUSE Manager Proxy Module 4.1	Fixed
SUSE Manager Proxy Module 4.2	Fixed
openSUSE Leap 15.3	Fixed
openSUSE Leap 15.4	Fixed
openSUSE Leap 15.5	Fixed
SUSE Multi Linux Manager Tools SLE-15	Fixed

React CVE-2026-22030

Severity by source

CVSS VectorGitHub Advisory

Lifecycle Timeline

Blast Radius

DescriptionGitHub Advisory

AnalysisAI

Technical ContextAI

RemediationAI

More in React

Same weakness CWE-346 – Origin Validation Error

Same technique CSRF

Vendor StatusVendor

SUSE

Share

External POC / Exploit Code