Go to packages list

react-router

Ecosystem: npm

Downloads: 247.59 Mln

Vulnerabilities from the last (months)
  • 0CriticalAffects 0 versions
  • 11HighAffects 12 versions
  • 0MediumAffects 0 versions
  • 8ModerateAffects 10 versions
  • 1LowAffects 1 version
Severity distribution (all time)
20vulnerabilities
  • Critical0 (0.0%)
  • High11 (55.0%)
  • Medium0 (0.0%)
  • Moderate8 (40.0%)
  • Low1 (5.0%)

Monthly breakdown

  • Critical
  • High
  • Medium
  • Moderate
  • Low
  • 6 vulnerabilities
    • Critical: 0
    • High: 2
    • Medium: 0
    • Moderate: 4
    • Low: 0
  • 7 vulnerabilities
    • Critical: 0
    • High: 4
    • Medium: 0
    • Moderate: 2
    • Low: 1
  • 5 vulnerabilities
    • Critical: 0
    • High: 3
    • Medium: 0
    • Moderate: 2
    • Low: 0
  • 2 vulnerabilities
    • Critical: 0
    • High: 2
    • Medium: 0
    • Moderate: 0
    • Low: 0

Vulnerabilities (20)

Known vulnerabilities affecting react-router, based on data from OSV.

Vulnerabilities affecting react-router
IDSeveritySummaryAffected versionsPublishedSource
GHSA-chx6-hx7r-mcp5HighReact Router: Unauthenticated Denial of Service via Inefficient Route MatchingThis is a follow up to https://github.com/remix-run/react-router/security/advisories/GHSA-8x6r-g9mw-2r78 that covers additional reported scenarios in which the manifest endpoint could be accessed via unauthenticated targeted requests that would put heavy load on the server and slow down response times. > [!NOTE] > This only impacts Framework Mode applications. This does not impact your application if you are using Declarative or Data Mode.
  • >= 7.0.0, < 7.18.0
GitHub (opens in a new tab)
GHSA-qwww-vcr4-c8h2HighReact Router: RSC Mode CSRF Bypass Allows Action Execution Before 400 ResponseThis is a follow up to CVE-2026-22030 to address related CSRF flows in unstable RSC code paths. > [!NOTE] > This only affects your application if you are using the unstable RSC APIs
  • >= 7.12.0, < 7.18.2
  • >= 8.0.0, < 8.3.0
GitHub (opens in a new tab)
GHSA-337j-9hxr-rhxgModerateReact Router: Arbitrary Constructor Injection via deserializeErrors() in React Router SSR HydrationIf application code allows attacker supplied input to overwrite certain aspects of errors caught by the SSR process, then it was possible for attacker to trigger unexpected constructor execution on the client which would trigger outbound network traffic. This is only possible with very specific (and unlikely) application layer code. > [!NOTE] > This does not impact your application if you are using Declarative Mode. This only impacts Framework Mode and Data Mode applications doing manual SSR/hydration
  • >= 6.4.0, < 7.18.0
GitHub (opens in a new tab)
GHSA-h8fp-f39c-q6mhModerateReact Router: RSCErrorHandler Missing Protocol Validation (XSS)This is a follow up to https://github.com/remix-run/react-router/security/advisories/GHSA-8646-j5j9-6r62. React Router was alerted of a code path in the (unstable) RSC error handling path in which redirects from untrusted sources could still result in an XSS vector via attacker-supplied redirect targets > [!NOTE] > This only affects your application if you are using the unstable RSC APIs
  • >= 7.11.0, < 7.18.0
GitHub (opens in a new tab)
GHSA-jjmj-jmhj-qwj2ModerateReact Router: Open redirect leading to XSSApplications with open redirects could permit attacker crafted links to result in redirects to unexpected external location or XSS vectors.
  • >= 7.9.6, < 7.13.0
GitHub (opens in a new tab)
GHSA-wrjc-x8rr-h8h6ModerateReact Router: Open redirect via backslash in <Link> and useNavigate (CVE-2025-68470 bypass)This is a follow up to [CVE-2025-68470](https://github.com/remix-run/react-router/security/advisories/GHSA-9jcx-v3wj-wh4m). React Router was alerted to certain scenarios in which the fix there was incomplete so there still existed some scenarios where attacker supplied paths passed to navigation mechanisms could result in unexpected external navigations.
  • >= 6.0.0, < 7.18.0
GitHub (opens in a new tab)
GHSA-84g9-w2xq-vcv6LowReact Router: Potential CSRF via PUT/PATCH/DELETE document requestsCertain CSRF checks in React Router v7 [Framework Mode]() were insufficient and run on POST requests, but were bypassed on PUT/PATCH/DELETE requests. This is a low severity vulnerability because modern browser protections (CORS preflight, SameSite cookies) already block the cross-origin attack vectors that this missing CSRF check would otherwise gate. > [!NOTE] > This does not impact your React Router application if you are using [Declarative Mode](https://reactrouter.com/start/modes#framework) (`<BrowserRouter>`) or [Data Mode](https://reactrouter.com/start/modes#data) (`createBrowserRouter
  • >= 7.12.0, < 7.15.1
GitHub (opens in a new tab)
GHSA-rxv8-25v2-qmq8HighReact Router vulnerable to Denial of Service via reflected user input in single-fetchA DoS vulnerability exists in the React Router v7 [Framework Mode](https://reactrouter.com/start/modes#framework), as well as Remix v2.9.0+ with [Single Fetch](https://v2.remix.run/docs/guides/single-fetch) enabled. In some scenarios the underlying serialization algorithm can become a bottleneck when encoding specific types of data into server responses. Please upgrade to React Router v7.14.0 or later. > [!NOTE] > This does not impact your React Router application if you are using [Declarative Mode](https://reactrouter.com/start/modes#declarative) (`<BrowserRouter>`) or [Data Mode](https://r
  • >= 7.0.0, < 7.14.0
GitHub (opens in a new tab)
GHSA-2j2x-hqr9-3h42ModerateReact Router's same-origin redirect with path starting // causes open redirect via protocol-relative URL reinterpretationCertain URLs passed to the `redirect` function can trigger an open redirect to an external domain depending on the level of validation done by the application prior to returning the `redirect`. > [!NOTE] > This does not impact your React Router application if you are using [Declarative Mode](https://reactrouter.com/start/modes#declarative) (`<BrowserRouter>`)
  • >= 7.0.0, < 7.14.1
  • >= 6.7.0, < 6.30.4
GitHub (opens in a new tab)
GHSA-49rj-9fvp-4h2hHighReact Router's vendored turbo-stream v2 allows arbitrary constructor invocation via TYPE_ERROR deserialization leading to Unauth RCEWhen using React Router v7 in [Framework Mode](https://reactrouter.com/start/modes#framework), there exists a combination of steps that could potentially allow unauthorized RCE through external requests. This first requires the application code to have an existing prototype pollution vulnerability. This can be leveraged into a 2-step attack in which the second step can trigger unauthorized RCE on the remote server. > [!NOTE] > This does not impact your React Router application if you are using [Declarative Mode](https://reactrouter.com/start/modes#declarative) (`<BrowserRouter>`) or [Data M
  • >= 7.0.0, < 7.14.2
GitHub (opens in a new tab)
  • GHSA-chx6-hx7r-mcp5High
    React Router: Unauthenticated Denial of Service via Inefficient Route Matching
    • >= 7.0.0, < 7.18.0
    GitHub (opens in a new tab)

    This is a follow up to https://github.com/remix-run/react-router/security/advisories/GHSA-8x6r-g9mw-2r78 that covers additional reported scenarios in which the manifest endpoint could be accessed via unauthenticated targeted requests that would put heavy load on the server and slow down response times. > [!NOTE] > This only impacts Framework Mode applications. This does not impact your application if you are using Declarative or Data Mode.

    CVE: CVE-2026-55685

  • GHSA-qwww-vcr4-c8h2High
    React Router: RSC Mode CSRF Bypass Allows Action Execution Before 400 Response
    • >= 7.12.0, < 7.18.2
    • >= 8.0.0, < 8.3.0
    GitHub (opens in a new tab)

    This is a follow up to CVE-2026-22030 to address related CSRF flows in unstable RSC code paths. > [!NOTE] > This only affects your application if you are using the unstable RSC APIs

  • GHSA-337j-9hxr-rhxgModerate
    React Router: Arbitrary Constructor Injection via deserializeErrors() in React Router SSR Hydration
    • >= 6.4.0, < 7.18.0
    GitHub (opens in a new tab)

    If application code allows attacker supplied input to overwrite certain aspects of errors caught by the SSR process, then it was possible for attacker to trigger unexpected constructor execution on the client which would trigger outbound network traffic. This is only possible with very specific (and unlikely) application layer code. > [!NOTE] > This does not impact your application if you are using Declarative Mode. This only impacts Framework Mode and Data Mode applications doing manual SSR/hydration

    CVE: CVE-2026-53666

  • GHSA-h8fp-f39c-q6mhModerate
    React Router: RSCErrorHandler Missing Protocol Validation (XSS)
    • >= 7.11.0, < 7.18.0
    GitHub (opens in a new tab)

    This is a follow up to https://github.com/remix-run/react-router/security/advisories/GHSA-8646-j5j9-6r62. React Router was alerted of a code path in the (unstable) RSC error handling path in which redirects from untrusted sources could still result in an XSS vector via attacker-supplied redirect targets > [!NOTE] > This only affects your application if you are using the unstable RSC APIs

    CVE: CVE-2026-53667

  • GHSA-jjmj-jmhj-qwj2Moderate
    React Router: Open redirect leading to XSS
    • >= 7.9.6, < 7.13.0
    GitHub (opens in a new tab)

    Applications with open redirects could permit attacker crafted links to result in redirects to unexpected external location or XSS vectors.

    CVE: CVE-2026-53668

  • GHSA-wrjc-x8rr-h8h6Moderate
    React Router: Open redirect via backslash in <Link> and useNavigate (CVE-2025-68470 bypass)
    • >= 6.0.0, < 7.18.0
    GitHub (opens in a new tab)

    This is a follow up to [CVE-2025-68470](https://github.com/remix-run/react-router/security/advisories/GHSA-9jcx-v3wj-wh4m). React Router was alerted to certain scenarios in which the fix there was incomplete so there still existed some scenarios where attacker supplied paths passed to navigation mechanisms could result in unexpected external navigations.

    CVE: CVE-2026-53669

  • GHSA-84g9-w2xq-vcv6Low
    React Router: Potential CSRF via PUT/PATCH/DELETE document requests
    • >= 7.12.0, < 7.15.1
    GitHub (opens in a new tab)

    Certain CSRF checks in React Router v7 [Framework Mode]() were insufficient and run on POST requests, but were bypassed on PUT/PATCH/DELETE requests. This is a low severity vulnerability because modern browser protections (CORS preflight, SameSite cookies) already block the cross-origin attack vectors that this missing CSRF check would otherwise gate. > [!NOTE] > This does not impact your React Router application if you are using [Declarative Mode](https://reactrouter.com/start/modes#framework) (`<BrowserRouter>`) or [Data Mode](https://reactrouter.com/start/modes#data) (`createBrowserRouter

    CVE: CVE-2026-53663

  • GHSA-rxv8-25v2-qmq8High
    React Router vulnerable to Denial of Service via reflected user input in single-fetch
    • >= 7.0.0, < 7.14.0
    GitHub (opens in a new tab)

    A DoS vulnerability exists in the React Router v7 [Framework Mode](https://reactrouter.com/start/modes#framework), as well as Remix v2.9.0+ with [Single Fetch](https://v2.remix.run/docs/guides/single-fetch) enabled. In some scenarios the underlying serialization algorithm can become a bottleneck when encoding specific types of data into server responses. Please upgrade to React Router v7.14.0 or later. > [!NOTE] > This does not impact your React Router application if you are using [Declarative Mode](https://reactrouter.com/start/modes#declarative) (`<BrowserRouter>`) or [Data Mode](https://r

    CVE: CVE-2026-34077

  • GHSA-2j2x-hqr9-3h42Moderate
    React Router's same-origin redirect with path starting // causes open redirect via protocol-relative URL reinterpretation
    • >= 7.0.0, < 7.14.1
    • >= 6.7.0, < 6.30.4
    GitHub (opens in a new tab)

    Certain URLs passed to the `redirect` function can trigger an open redirect to an external domain depending on the level of validation done by the application prior to returning the `redirect`. > [!NOTE] > This does not impact your React Router application if you are using [Declarative Mode](https://reactrouter.com/start/modes#declarative) (`<BrowserRouter>`)

    CVE: CVE-2026-40181

  • GHSA-49rj-9fvp-4h2hHigh
    React Router's vendored turbo-stream v2 allows arbitrary constructor invocation via TYPE_ERROR deserialization leading to Unauth RCE
    • >= 7.0.0, < 7.14.2
    GitHub (opens in a new tab)

    When using React Router v7 in [Framework Mode](https://reactrouter.com/start/modes#framework), there exists a combination of steps that could potentially allow unauthorized RCE through external requests. This first requires the application code to have an existing prototype pollution vulnerability. This can be leveraged into a 2-step attack in which the second step can trigger unauthorized RCE on the remote server. > [!NOTE] > This does not impact your React Router application if you are using [Declarative Mode](https://reactrouter.com/start/modes#declarative) (`<BrowserRouter>`) or [Data M

    CVE: CVE-2026-42211

Showing 1-10 of 20 vulnerabilities