Medium severity · published Jun 2, 2026
CVE-2026-40181
React Router's same-origin redirect with path starting // causes open redirect via protocol-relative URL reinterpretation
6.1
CVSS
0.2%
EPSS
No
On KEV
Description
React Router is a router for React. In versions 7.0.0 through 7.14.0 and 6.7.0 through 6.30.3, certain URLs passed to the redirect function can trigger an open redirect to an external domain due to path values starting with // being reinterpreted as protocol-relative URLs. The level of impact depends on the validation done by the application prior to returning the redirect. This does not impact applications using Declarative Mode (<BrowserRouter>). This is patched in versions 7.14.1 and 6.30.4.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 13% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
RE
@remix-run/router · remix-run
>= 1.3.0, < 1.23.3 · source: vendor
RE
react-router · remix-run
>= 7.0.0, < 7.14.1; >= 6.7.0, < 6.30.4 · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-40181
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-40181
Vendor Advisory
https://github.com/remix-run/react-router/security/advisories/GHSA-2j2x-hqr9-3h42
More from @remix-run/router
6.1
CVE-2026-22029
React Router vulnerable to XSS via Open Redirects