React Router: `handleDocumentRequest` CSRF check covers `POST` only; PUT/PATCH/DELETE bypass

Publishers link these advisories through the identifiers shown below. A shared identifier or date alone does not tell you whether your software is affected or whether the advisories describe the same cause.

CVE-2026-53663 · CVE overview and exploitation status

EUVD-2026-38338

GHSA-84g9-w2xq-vcv6

cve-program · CVE-2026-53663

• https://github.com/remix-run/react-router/security/advisories/GHSA-84g9-w2xq-vcv6

euvd · EUVD-2026-38338

• https://github.com/remix-run/react-router/security/advisories/GHSA-84g9-w2xq-vcv6

nvd · CVE-2026-53663

• https://github.com/remix-run/react-router/security/advisories/GHSA-84g9-w2xq-vcv6

osv · GHSA-84g9-w2xq-vcv6

• https://github.com/remix-run/react-router/security/advisories/GHSA-84g9-w2xq-vcv6
• https://github.com/remix-run/react-router

No related changes are available here.