GHSA-qwww-vcr4-c8h2: split affected range — fix backported to react-router 7.18.2

[BenjaminLimb]

Summary

GHSA-qwww-vcr4-c8h2 currently declares a single affected range of >= 7.12.0, < 8.3.0 with a first patched version of 8.3.0. Because that range spans the 7.x and 8.x lines continuously, it marks every 7.x release above 7.12.0 as unpatched — including react-router@7.18.2, which carries the fix backported to the v7 branch.

The advisory record was last modified 2026-07-24T16:44:43Z. The v7 backport merged 2026-07-28T20:52:11Z, four days later, so the record predates it.

Upstream evidence

• The fix on main is commit 7a71c728 (PR #15311), released in react-router@8.3.0. That part of the record is correct.
• Maintainers backported it to the v7 branch in PR #15353 ("Backport RSC CSRF hardening to v7"), merged into base v7 on 2026-07-28 as commit 8ebd5df, closing #15348 which requested exactly this.
• The backport changes the same file as the v8 fix, packages/react-router/lib/rsc/server.rsc.ts, with the same remediation: the CSRF check's catch now downgrades the request to GET before query() runs, so no route action can execute on a request flagged as a potential CSRF attack. The two diffs are equivalent apart from an added explanatory comment.
• The backport commit is contained in the react-router@7.18.2 tag (published 2026-07-28T21:53:57Z); comparing 8ebd5df...react-router@7.18.2 is behind_by: 0. Reading server.rsc.ts at each tag shows the vulnerable shape at 7.18.1 and the fixed shape at 7.18.2.
• 7.18.2 is the highest published 7.x release and is the current version-7 dist-tag on npm; 8.0.0 is the lowest published 8.x release.

The v7 line was genuinely affected — the vulnerable code is present at 7.18.1 — so the 7.x range should be retained rather than removed, with its own fixed version.

Requested change

Split the single range into two per-branch affected entries:

	Current	Proposed
7.x	(covered by the combined range)	>= 7.12.0, < 7.18.2, first patched 7.18.2
8.x	>= 7.12.0, < 8.3.0, first patched 8.3.0	>= 8.0.0, < 8.3.0, first patched 8.3.0

The introduced boundary of 7.12.0 and the 8.3.0 fixed version are left unchanged.

Also adds two references supporting the new range: the backport PR (#15353) and the react-router@7.18.2 release tag.

This follows the same per-branch affected modelling already used elsewhere in this repository for packages with concurrently maintained major lines (for example GHSA-68g3-v927-f742).

[Copilot]

Pull request overview

Updates the React Router advisory to recognize the v7 security-fix backport.

Changes:

• Splits affected ranges for React Router 7.x and 8.x.
• Marks 7.18.2 as the first patched v7 release.
• Adds supporting backport and release references.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.