RE
Product
react-router
18
CVEs
0
On KEV
9.1
Max CVSS
0
New 30D
Severity mix
Critical 1High 6Medium 10Low 1
Watch
Add react-router to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2025-61686 | 9.1 | Jan 10 | React Router has Path Traversal in File Session Storage Affected: @react-router/node >= 7.0.0, < 7.9.4; @remix-run/deno < 2.17.2; @remix-run/node < 2.17.2 |
| CVE-2026-21884 | 8.2 | Jan 10 | React Router SSR XSS in ScrollRestoration Affected: @remix-run/react < 2.17.3; react-router >= 7.0.0, < 7.12.0 |
| CVE-2026-42211 | 8.1 | Jun 2 | React Router's vendored turbo-stream v2 allows arbitrary constructor invocation via TYPE_ERROR deserialization leading to Unauth RCE Affected: >= 7.0.0, < 7.14.2 |
| CVE-2025-59057 | 7.6 | Jan 10 | React Router has XSS Vulnerability Affected: @remix-run/react >= 1.15.0, < 2.17.1; react-router >= 7.0.0, < 7.9.0 |
| CVE-2026-55685 | 7.5 | Jul 27 | React Router: Unauthenticated Denial of Service via Inefficient Route Matching Affected: >= 7.0.0, < 7.18.0 |
| CVE-2026-42342 | 7.5 | Jun 2 | React Router vulnerable to DoS via unbounded path expansion in __manifest endpoint Affected: >= 7.0.0, < 7.15.0 |
| CVE-2026-34077 | 7.5 | Jun 2 | React Router vulnerable to Denial of Service via reflected user input in single-fetch Affected: >= 7.0.0, < 7.14.0 |
| CVE-2026-53668 | 6.9 | Jul 27 | React Router: Open redirect can lead to XSS Affected: >= 6.30.2, <= 6.30.4; >= 7.9.6, < 7.13.0 |
| CVE-2026-22030 | 6.5 | Jan 10 | React Router has CSRF issue in Action/Server Action Request Processing Affected: @remix-run/router < 2.17.3; react-router >= 7.0.0, < 7.12.0 |
| CVE-2025-68470 | 6.5 | Jan 10 | React Router has unexpected external redirect via untrusted paths Affected: >= 7.0.0, < 7.9.6; >= 6.0.0, < 6.30.2 |
| CVE-2026-53669 | 6.1 | Jul 27 | React Router: Open redirect via backslash in <Link> and useNavigate (CVE-2025-68470 bypass) Affected: >= 6.0.0, < 7.18.0 |
| CVE-2026-53667 | 6.1 | Jul 27 | React Router: Cross-site Scripting is Possible due to Missing RSCErrorHandler Protocol Validation (Incomplete fix for CVE-2026-53667) Affected: >= 7.11.0, < 7.18.0 |
| CVE-2026-53666 | 6.1 | Jul 27 | React Router: Arbitrary Constructor Injection via deserializeErrors() in React Router SSR Hydration Affected: >= 6.4.0, < 7.18.0 |
| CVE-2026-40181 | 6.1 | Jun 2 | React Router's same-origin redirect with path starting // causes open redirect via protocol-relative URL reinterpretation Affected: >= 7.0.0, < 7.14.1; >= 6.7.0, < 6.30.4 |
| CVE-2026-22029 | 6.1 | Jan 10 | React Router vulnerable to XSS via Open Redirects Affected: >= 7.0.0, < 7.12.0 |
| CVE-2026-33244 | 5.4 | Jun 2 | React Router has stored XSS via unescaped Location header in prerendered redirect HTML Affected: >= 7.5.1, < 7.13.2 |
| CVE-2026-33245 | 4.7 | Jun 2 | React Router vulnerable to XSS in unstable RSC redirect handling via javascript: redirect targets Affected: >= 7.7.0, < 7.13.2 |
| CVE-2026-53663 | 3.1 | Jun 22 | React Router: `handleDocumentRequest` CSRF check covers `POST` only; PUT/PATCH/DELETE bypass Affected: >= 7.12.0, < 7.15.1 |
Showing 18