What’s Vulnerable › Vulnerabilities
CVE-2026-40181: React Router's same-origin redirect with path starting // causes open redirect via protocol-relative URL reinterpretation
- Severity: medium (CVSS 6.1 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.2% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2026-06-02 · updated 2026-08-04
- Weakness: CWE-601
Description
React Router is a router for React. In versions 7.0.0 through 7.14.0 and 6.7.0 through 6.30.3, certain URLs passed to the redirect function can trigger an open redirect to an external domain due to path values starting with // being reinterpreted as protocol-relative URLs. The level of impact depends on the validation done by the application prior to returning the redirect. This does not impact applications using Declarative Mode (<BrowserRouter>). This is patched in versions 7.14.1 and 6.30.4.
Affected products
- remix-run react-router: from 6.7.0 before 6.30.4; from 7.0.0 before 7.14.1 — fixed in 6.30.4, 7.14.1
How to fix
Upgrade to a fixed version: remix-run react-router 6.30.4, 7.14.1. Check the vendor advisory for mitigations.
References
Get alerted when CVE-2026-40181 or the next vulnerability affects your stack