---
id: CVE-2025-59057
title: React Router is a router for React
summary: >-
  React Router is a router for React. In @remix-run/react versions 1.15.0
  through 2.17.0. and react-router versions 7.0.0 through 7.8.2, a XSS
  vulnerability exists in in React Router's meta()/<Meta> APIs in Framework Mode
  when generating s…
severity: high
cvss: 7.6
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N'
cwe:
  - CWE-79
vendor: shopify
product: react-router
affected:
  - 'react-router >= 7.0.0, <= 7.8.2'
  - 'remix-run/react >= 1.15.0, <= 2.17.0'
published: '2026-01-10'
updated: '2026-06-30'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2025-59057'
references:
  - url: >-
      https://github.com/remix-run/react-router/security/advisories/GHSA-3cgp-3xvw-98x8
    label: security-advisories@github.com
  - url: 'https://access.redhat.com/errata/RHSA-2026:19712'
    label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
  - url: 'https://access.redhat.com/errata/RHSA-2026:3782'
    label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
  - url: 'https://access.redhat.com/errata/RHSA-2026:3958'
    label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
  - url: 'https://access.redhat.com/errata/RHSA-2026:3960'
    label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
  - url: 'https://access.redhat.com/security/cve/CVE-2025-59057'
    label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2428426'
    label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-59057.json
    label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2025-59057'
  - url: 'https://github.com/remix-run/react-router/pull/14316'
  - url: >-
      https://github.com/remix-run/react-router/commit/0e774855797fcb3c7538c269158f4541beb55a1b
  - url: 'https://github.com/remix-run/react-router/blob/main/CHANGELOG.md#v790'
  - url: 'https://github.com/remix-run/react-router/releases/tag/react-router@7.9.0'
  - url: 'https://github.com/advisories/GHSA-3cgp-3xvw-98x8'
tags:
  - nvd
  - exploit-available
  - ghsa
  - npm
epss: 0.00511
epssPercentile: 0.41082
ingestedAt: '2026-06-30T13:26:50.275Z'
exploits:
  github: 1
  githubRepos:
    - 'https://github.com/boroeurnprach/CVE-2025-59057-PoC'
  checkedAt: '2026-09-26T09:05:36.025Z'
exploitAvailable: true
aliases:
  - GHSA-3cgp-3xvw-98x8
ecosystem: npm
patched:
  - react-router 7.9.0
  - '@remix-run/react 2.17.1'
---

## Overview

React Router is a router for React. In @remix-run/react versions 1.15.0 through 2.17.0. and react-router versions 7.0.0 through 7.8.2, a XSS vulnerability exists in in React Router's meta()/<Meta> APIs in Framework Mode when generating script:ld+json tags which could allow arbitrary JavaScript execution during SSR if untrusted content is used to generate the tag. There is no impact if the application is being used in Declarative Mode (<BrowserRouter>) or Data Mode (createBrowserRouter/<RouterProvider>). This issue has been patched in @remix-run/react version 2.17.1 and react-router version 7.9.0.

## Affected

- `react-router >= 7.0.0, <= 7.8.2`
- `remix-run/react >= 1.15.0, <= 2.17.0`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Package advisory (CVE-2025-59057)

Affected packages:

- `react-router >= 7.0.0, <= 7.8.2`
- `@remix-run/react >= 1.15.0, <= 2.17.0`

Patched in:

- `react-router 7.9.0`
- `@remix-run/react 2.17.1`

Source: https://github.com/advisories/GHSA-3cgp-3xvw-98x8