remix-run react-router
21 published vulnerabilities name this product.
As the CNAs write it in their CVE records (vendor and product); the versions are theirs.
| CVE | Vulnerable versions | Title | Severity | Published | EPSS | Exploitation |
|---|---|---|---|---|---|---|
| CVE-2026-53669 | >= 6.0.0, < 7.18.0 | React Router: Open redirect via backslash in <Link> and useNavigate (CVE-2025-68470 bypass) | MEDIUM 5.1 | 0.3 % | ||
| CVE-2026-55685 | >= 7.0.0, < 7.18.0 | React Router: Unauthenticated Denial of Service via Inefficient Route Matching | HIGH 8.7 | 0.7 % | ||
| CVE-2026-53668 | >= 6.30.2, <= 6.30.4 ; >= 7.9.6, < 7.13.0 | React Router: Open redirect can lead to XSS | MEDIUM 6.9 | 0.3 % | ||
| CVE-2026-53667 | >= 7.11.0, < 7.18.0 | React Router: Cross-site Scripting is Possible due to Missing RSCErrorHandler Protocol Validation (Incomplete fix for CVE-2026-53667) | MEDIUM 6.9 | 0.4 % | ||
| CVE-2026-53666 | >= 6.4.0, < 7.18.0 | React Router: Arbitrary Constructor Injection via deserializeErrors() in React Router SSR Hydration | MEDIUM 6.1 | 0.4 % | ||
| CVE-2026-53663 | >= 7.12.0, < 7.15.1 | React Router: `handleDocumentRequest` CSRF check covers `POST` only; PUT/PATCH/DELETE bypass | LOW 3.1 | 0.1 % | ||
| CVE-2026-42342 | >= 7.0.0, < 7.15.0 | React Router vulnerable to DoS via unbounded path expansion in __manifest endpoint | HIGH 7.5 | 0.3 % | ||
| CVE-2026-42211 | >= 7.0.0, < 7.14.2 | React Router's vendored turbo-stream v2 allows arbitrary constructor invocation via TYPE_ERROR deserialization leading to Unauth RCE | HIGH 8.1 | 0.4 % | ||
| CVE-2026-40181 | >= 7.0.0, < 7.14.1 ; >= 6.7.0, < 6.30.4 | React Router's same-origin redirect with path starting // causes open redirect via protocol-relative URL reinterpretation | MEDIUM 6.6 | 0.2 % | ||
| CVE-2026-34077 | >= 7.0.0, < 7.14.0 | React Router vulnerable to Denial of Service via reflected user input in single-fetch | HIGH 7.5 | 0.3 % | ||
| CVE-2026-33245 | >= 7.7.0, < 7.13.2 | React Router vulnerable to XSS in unstable RSC redirect handling via javascript: redirect targets | HIGH 8.0 | 0.2 % | ||
| CVE-2026-33244 | >= 7.5.1, < 7.13.2 | React Router has stored XSS via unescaped Location header in prerendered redirect HTML | MEDIUM 5.4 | 0.1 % | ||
| CVE-2026-22030 | @remix-run/router < 2.17.3 ; react-router >= 7.0.0, < 7.12.0 | React Router has CSRF issue in Action/Server Action Request Processing | MEDIUM 6.5 | 0.2 % | ||
| CVE-2026-22029 | >= 7.0.0, < 7.12.0 | React Router vulnerable to XSS via Open Redirects | HIGH 8.0 | 0.9 % | ||
| CVE-2026-21884 | @remix-run/react < 2.17.3 ; react-router >= 7.0.0, < 7.12.0 | React Router SSR XSS in ScrollRestoration | HIGH 8.2 | 0.5 % | ||
| CVE-2025-61686 | @react-router/node >= 7.0.0, < 7.9.4 ; @remix-run/deno < 2.17.2 ; @remix-run/node < 2.17.2 | React Router has Path Traversal in File Session Storage | CRITICAL 9.1 | 17 % | ||
| CVE-2025-59057 | @remix-run/react >= 1.15.0, < 2.17.1 ; react-router >= 7.0.0, < 7.9.0 | React Router has XSS Vulnerability | HIGH 7.6 | 0.5 % | ||
| CVE-2025-68470 | >= 7.0.0, < 7.9.6 ; >= 6.0.0, < 6.30.2 | React Router has unexpected external redirect via untrusted paths | MEDIUM 6.5 | 0.5 % | ||
| CVE-2025-43865 | >= 7.0, < 7.5.2 | React Router allows pre-render data spoofing on React-Router framework mode | HIGH 8.2 | 0.8 % | ||
| CVE-2025-43864 | >= 7.2.0, < 7.5.2 | React Router allows a DoS via cache poisoning by forcing SPA mode | HIGH 7.5 | 20 % | ||
| CVE-2025-31137 | >= 7.0.0, < 7.4.1 ; >= 2.11.1, < 2.16.3 | Remix and React Router allow URL manipulation via Host / X-Forwarded-Host headers | HIGH 7.5 | 1.2 % |