Login Request a demo
RE
Product
react-router
by remix-run · last CVE Jul 27, 2026
18
CVEs
0
On KEV
9.1
Max CVSS
0
New 30D
Vulnerabilities18In the news0Timeline
Severity mix
Critical 1High 6Medium 10Low 1
Severity
All severities18Critical1High6Medium10Low1
Exploitation
On CISA KEV0Exploited in the wild0
Watch

Add react-router to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2026-53668
6.9
0%
Jul 27
React Router: Open redirect can lead to XSS
Affected: >= 6.30.2, <= 6.30.4; >= 7.9.6, < 7.13.0
CVE-2026-22030
6.5
0%
Jan 10
React Router has CSRF issue in Action/Server Action Request Processing
Affected: @remix-run/router < 2.17.3; react-router >= 7.0.0, < 7.12.0
CVE-2025-68470
6.5
0%
Jan 10
React Router has unexpected external redirect via untrusted paths
Affected: >= 7.0.0, < 7.9.6; >= 6.0.0, < 6.30.2
CVE-2026-53669
6.1
0%
Jul 27
React Router: Open redirect via backslash in <Link> and useNavigate (CVE-2025-68470 bypass)
Affected: >= 6.0.0, < 7.18.0
CVE-2026-53667
6.1
0%
Jul 27
React Router: Cross-site Scripting is Possible due to Missing RSCErrorHandler Protocol Validation (Incomplete fix for CVE-2026-53667)
Affected: >= 7.11.0, < 7.18.0
CVE-2026-53666
6.1
0%
Jul 27
React Router: Arbitrary Constructor Injection via deserializeErrors() in React Router SSR Hydration
Affected: >= 6.4.0, < 7.18.0
CVE-2026-40181
6.1
0%
Jun 2
React Router's same-origin redirect with path starting // causes open redirect via protocol-relative URL reinterpretation
Affected: >= 7.0.0, < 7.14.1; >= 6.7.0, < 6.30.4
CVE-2026-22029
6.1
1%
Jan 10
React Router vulnerable to XSS via Open Redirects
Affected: >= 7.0.0, < 7.12.0
CVE-2026-33244
5.4
0%
Jun 2
React Router has stored XSS via unescaped Location header in prerendered redirect HTML
Affected: >= 7.5.1, < 7.13.2
CVE-2026-33245
4.7
0%
Jun 2
React Router vulnerable to XSS in unstable RSC redirect handling via javascript: redirect targets
Affected: >= 7.7.0, < 7.13.2
Showing 10