What’s Vulnerable › Products

remix-run react-router vulnerabilities

20 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 20 published in the last 12 months.

Check whether your remix-run react-router version is affected

Latest remix-run react-router vulnerabilities

• CVE-2026-55685 — React Router: Unauthenticated Denial of Service via Inefficient Route Matching (CVSS 7.5)
• CVE-2026-53669 — React Router: Open redirect via backslash in <Link> and useNavigate (CVE-2025-68470 bypass) (CVSS 6.1)
• CVE-2026-53668 — React Router: Open redirect can lead to XSS (CVSS 6.9)
• CVE-2026-53667 — React Router: Cross-site Scripting is Possible due to Missing RSCErrorHandler Protocol Validation (Incomplete fix for CVE-2026-53667) (CVSS 6.1)
• CVE-2026-53666 — React Router: Arbitrary Constructor Injection via deserializeErrors() in React Router SSR Hydration (CVSS 6.1)
• CVE-2026-53663 — React Router: `handleDocumentRequest` CSRF check covers `POST` only; PUT/PATCH/DELETE bypass (CVSS 3.1)
• CVE-2026-42342 — React Router vulnerable to DoS via unbounded path expansion in __manifest endpoint (CVSS 7.5)
• CVE-2026-42211 — React Router's vendored turbo-stream v2 allows arbitrary constructor invocation via TYPE_ERROR deserialization leading to Unauth RCE (CVSS 8.1)
• CVE-2026-40181 — React Router's same-origin redirect with path starting // causes open redirect via protocol-relative URL reinterpretation (CVSS 6.1)
• CVE-2026-34077 — React Router vulnerable to Denial of Service via reflected user input in single-fetch (CVSS 7.5)
• CVE-2026-33245 — React Router vulnerable to XSS in unstable RSC redirect handling via javascript: redirect targets (CVSS 4.7)
• CVE-2026-33244 — React Router has stored XSS via unescaped Location header in prerendered redirect HTML (CVSS 5.4)
• CVE-2026-22030 — React Router has CSRF issue in Action/Server Action Request Processing (CVSS 6.5)
• CVE-2026-22029 — React Router vulnerable to XSS via Open Redirects (CVSS 6.1)
• CVE-2026-21884 — React Router SSR XSS in ScrollRestoration (CVSS 8.2)
• CVE-2025-68470 — React Router has unexpected external redirect via untrusted paths (CVSS 6.5)
• CVE-2025-59057 — React Router has XSS Vulnerability (CVSS 7.6)
• CVE-2025-43865 — React Router allows pre-render data spoofing on React-Router framework mode (CVSS 8.2)
• CVE-2025-43864 — React Router allows a DoS via cache poisoning by forcing SPA mode (CVSS 7.5)
• CVE-2025-31137 — Remix and React Router allow URL manipulation via Host / X-Forwarded-Host headers (CVSS 7.5)