RE
Vendor
remix-run
23
CVEs
0
On KEV
0
New 30D
Products
RE9.1
react-router
remix-run
18 CVEs0 on KEV0 new
RE6.1
@remix-run/router
remix-run
2 CVEs0 on KEV0 new
RE7.5
@remix-run/server-runtime
remix-run
1 CVEs0 on KEV0 new
SE3.1
server-runtime
@remix-run
1 CVEs0 on KEV0 new
TU7.5
turbo-stream
remix-run
1 CVEs0 on KEV0 new
Recent CVEs
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-53669 | RE react-router remix-run | 6.1 | Jul 27 | React Router: Open redirect via backslash in <Link> and useNavigate (CVE-2025-68470 bypass) |
| CVE-2026-55685 | RE react-router remix-run | 7.5 | Jul 27 | React Router: Unauthenticated Denial of Service via Inefficient Route Matching |
| CVE-2026-53668 | RE react-router remix-run | 6.9 | Jul 27 | React Router: Open redirect can lead to XSS |
| CVE-2026-53667 | RE react-router remix-run | 6.1 | Jul 27 | React Router: Cross-site Scripting is Possible due to Missing RSCErrorHandler Protocol Validation (Incomplete fix for CVE-2026-53667) |
| CVE-2026-53666 | RE react-router remix-run | 6.1 | Jul 27 | React Router: Arbitrary Constructor Injection via deserializeErrors() in React Router SSR Hydration |
| CVE-2026-53663 | RE react-router remix-run | 3.1 | Jun 22 | React Router: `handleDocumentRequest` CSRF check covers `POST` only; PUT/PATCH/DELETE bypass |
| CVE-2026-42342 | RE @remix-run/server-runtime remix-run | 7.5 | Jun 2 | React Router vulnerable to DoS via unbounded path expansion in __manifest endpoint |
| CVE-2026-42211 | RE react-router remix-run | 8.1 | Jun 2 | React Router's vendored turbo-stream v2 allows arbitrary constructor invocation via TYPE_ERROR deserialization leading to Unauth RCE |
| CVE-2026-40181 | RE @remix-run/router remix-run | 6.1 | Jun 2 | React Router's same-origin redirect with path starting // causes open redirect via protocol-relative URL reinterpretation |
| CVE-2026-34077 | RE react-router remix-run | 7.5 | Jun 2 | React Router vulnerable to Denial of Service via reflected user input in single-fetch |
| CVE-2026-33245 | RE react-router remix-run | 4.7 | Jun 2 | React Router vulnerable to XSS in unstable RSC redirect handling via javascript: redirect targets |
| CVE-2026-33244 | RE react-router remix-run | 5.4 | Jun 2 | React Router has stored XSS via unescaped Location header in prerendered redirect HTML |
| CVE-2026-22030 | RE react-router remix-run | 6.5 | Jan 10 | React Router has CSRF issue in Action/Server Action Request Processing |
| CVE-2026-22029 | RE react-router remix-run | 6.1 | Jan 10 | React Router vulnerable to XSS via Open Redirects |
| CVE-2026-21884 | RE react-router remix-run | 8.2 | Jan 10 | React Router SSR XSS in ScrollRestoration |
| CVE-2025-61686 | RE react-router remix-run | 9.1 | Jan 10 | React Router has Path Traversal in File Session Storage |
| CVE-2025-59057 | RE react-router remix-run | 7.6 | Jan 10 | React Router has XSS Vulnerability |
| CVE-2025-68470 | RE react-router remix-run | 6.5 | Jan 10 | React Router has unexpected external redirect via untrusted paths |