AIKIDO-2026-442287
remix-utils is vulnerable to Cross-Site Request Forgery (CSRF)
53
Medium Risk
This Affects:
remix-utilsTL;DR
The CSRF server helper in src/server/csrf.ts signs authenticity tokens with a plain SHA-256 hash of the token value and ignores the configured secret. Because the signature is an unkeyed hash, anyone can recompute a valid signature for any token value without knowing the secret, so forged or tampered tokens pass signature verification. Verification also compares signatures with a direct string equality check that is not constant-time. The fix signs tokens with HMAC-SHA256 keyed by the configured secret and verifies signatures using a constant-time comparison.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and configure the CSRF helper with a secret.
Background info
remix-utils is vulnerable to Cross-Site Request Forgery (CSRF) in versions 8.0.0 - 9.3.1.
How to fix this
Upgrade the remix-utils library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPImplementing© All Intel data is openly available and commercially licensed.