react-router vulnerabilities

CVEs whose affected-version data names the react-router package (npm). Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.

10 CVEsRSS

GHSA-qwww-vcr4-c8h2High

2mo ago

React Router: RSC Mode CSRF Bypass Allows Action Execution Before 400 Response

▾ Twilightreact-router · react-routervia GHSA

CVE-2026-53666Medium· 6.1

2mo ago

React Router: Arbitrary Constructor Injection via deserializeErrors() in React Router SSR Hydration

▾ Sunlitreact-router · react-routerEPSS 0.30%via GHSA

CVE-2026-53667Medium· 6.9

2mo ago

React Router: RSCErrorHandler Missing Protocol Validation (XSS)

▾ Sunlitreact-router · react-routerEPSS 0.20%via GHSA

CVE-2026-53668Medium· 6.9

2mo ago

React Router: Open redirect leading to XSS

▾ Sunlitreact-router · react-routerEPSS 0.28%via GHSA

CVE-2026-53669Medium

2mo ago

React Router: Open redirect via backslash in <Link> and useNavigate (CVE-2025-68470 bypass)

▾ Sunlitreact-router · react-routerEPSS 0.23%via GHSA

CVE-2026-53663Low· 3.1

3mo ago

React Router: Potential CSRF via PUT/PATCH/DELETE document requests

▾ Sunlitreact-router · react-routerEPSS 0.15%via GHSA

CVE-2026-33244Medium· 5.4

3mo ago

React Router has stored XSS via unescaped Location header in prerendered redirect HTML

▾ Sunlitreact-router · react-routerEPSS 0.14%via GHSA

CVE-2026-22029High· 8.0

8mo ago

React Router is a router for React

React Router is a router for React. In @remix-run/router version prior to 1.23.2 and react-router 7.0.0 through 7.11.0, React Router (and Remix v1/v2) SPA open navigation redirects originating from loaders or actions in Framework Mode, D…

▾ Twilightshopify · remix-run/reactEPSS 0.88%via NVD

CVE-2026-21884High· 8.2

8mo ago

React Router is a router for React

React Router is a router for React. In @remix-run/react version prior to 2.17.3. and react-router 7.0.0 through 7.11.0, a XSS vulnerability exists in in React Router's <ScrollRestoration> API in Framework Mode when using the getKey/stora…

▾ Twilightshopify · react-routerEPSS 0.54%via NVD

CVE-2025-59057High· 7.6PoC

8mo ago

React Router is a router for React

React Router is a router for React. In @remix-run/react versions 1.15.0 through 2.17.0. and react-router versions 7.0.0 through 7.8.2, a XSS vulnerability exists in in React Router's meta()/<Meta> APIs in Framework Mode when generating s…

▾ Midnightshopify · react-routerEPSS 0.51%via NVD