High severity · published Jun 2, 2026
CVE-2026-34077
React Router vulnerable to Denial of Service via reflected user input in single-fetch
7.5
CVSS
0.3%
EPSS
No
On KEV
Description
React Router is a router for React. In versions 7.7.0 through 7.13.1, when using React Router's unstable React Server Components (RSC) APIs, there is a potential client-side Cross-Site Scripting (XSS) vulnerability in the RSC redirect handling if redirects come from untrusted sources. This does not impact applications that are not using the unstable RSC APIs in React Router. This is patched in version 7.13.2.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 22% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
RE
react-router · remix-run
>= 7.0.0, < 7.14.0 · source: vendor, NVD
TU
turbo-stream · remix-run
< 3.0.0 · source: vendor
TS
Turbo Stream · Turbo-stream
before 3.0.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-34077
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-34077
Vendor Advisory
https://github.com/remix-run/react-router/security/advisories/GHSA-rxv8-25v2-qmq8
More from react-router
9.1
CVE-2025-61686
React Router has Path Traversal in File Session Storage
8.2
CVE-2026-21884
React Router SSR XSS in ScrollRestoration
8.1
CVE-2026-42211
React Router's vendored turbo-stream v2 allows arbitrary constructor invocation via TYPE_ERROR deserialization leading to Unauth RCE
7.6
CVE-2025-59057
React Router has XSS Vulnerability
7.5
CVE-2026-55685
React Router: Unauthenticated Denial of Service via Inefficient Route Matching