RE
Product
React-router
16
CVEs
0
On KEV
8.2
Max CVSS
0
New 30D
Severity mix
Critical 0High 6Medium 10Low 0
Watch
Add React-router to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-53668 | 6.9 | Jul 27 | React Router: Open redirect can lead to XSS Affected: 6.30.2 through 6.30.4; 7.9.6 before 7.13.0 |
| CVE-2026-22030 | 6.5 | Jan 10 | React Router has CSRF issue in Action/Server Action Request Processing Affected: 7.0.0 through 7.11.0 |
| CVE-2025-68470 | 6.5 | Jan 10 | React Router has unexpected external redirect via untrusted paths Affected: 6.0.0 through 6.30.1; 7.0.0 through 7.9.5 |
| CVE-2026-53669 | 6.1 | Jul 27 | React Router: Open redirect via backslash in <Link> and useNavigate (CVE-2025-68470 bypass) Affected: 6.0.0 before 7.18.0 |
| CVE-2026-53667 | 6.1 | Jul 27 | React Router: Cross-site Scripting is Possible due to Missing RSCErrorHandler Protocol Validation (Incomplete fix for CVE-2026-53667) Affected: 7.11.0 before 7.18.0 |
| CVE-2026-53666 | 6.1 | Jul 27 | React Router: Arbitrary Constructor Injection via deserializeErrors() in React Router SSR Hydration Affected: 6.4.0 before 7.18.0 |
| CVE-2026-40181 | 6.1 | Jun 2 | React Router's same-origin redirect with path starting // causes open redirect via protocol-relative URL reinterpretation Affected: 6.7.0 before 6.30.4; 7.0.0 before 7.14.1 |
| CVE-2026-22029 | 6.1 | Jan 10 | React Router vulnerable to XSS via Open Redirects Affected: 7.0.0 through 7.11.0 |
| CVE-2026-33244 | 5.4 | Jun 2 | React Router has stored XSS via unescaped Location header in prerendered redirect HTML Affected: 7.5.1 before 7.13.2 |
| CVE-2026-33245 | 4.7 | Jun 2 | React Router vulnerable to XSS in unstable RSC redirect handling via javascript: redirect targets Affected: 7.7.0 before 7.13.2 |
Showing 10