Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
20 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
This is a follow up to CVE-2026-22030 to address related CSRF flows in unstable RSC code paths. [!NOTE] This only affects your application if you are using the unstable RSC APIs
Recommended action: Upgrade to 8.3.0 or 7.18.2 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
This is a follow up to https://github.com/remix-run/react-router/security/advisories/GHSA-8x6r-g9mw-2r78 that covers additional reported scenarios in which the manifest endpoint could be accessed via unauthenticated targeted requests that would put heavy load on the server and slow down response times. [!NOTE] This only impacts Framework Mode applications. This does not impact your application if you are using Declarative or Data Mode.
Recommended action: Upgrade to 7.18.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
This is a follow up to CVE-2025-68470. React Router was alerted to certain scenarios in which the fix there was incomplete so there still existed some scenarios where attacker supplied paths passed to navigation mechanisms could result in unexpected external navigations.
Recommended action: Upgrade to 7.18.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Applications with open redirects could permit attacker crafted links to result in redirects to unexpected external location or XSS vectors.
Recommended action: Upgrade to 7.13.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
This is a follow up to https://github.com/remix-run/react-router/security/advisories/GHSA-8646-j5j9-6r62. React Router was alerted of a code path in the (unstable) RSC error handling path in which redirects from untrusted sources could still result in an XSS vector via attacker-supplied redirect targets [!NOTE] This only affects your application if you are using the unstable RSC APIs
Recommended action: Upgrade to 7.18.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
If application code allows attacker supplied input to overwrite certain aspects of errors caught by the SSR process, then it was possible for attacker to trigger unexpected constructor execution on the client which would trigger outbound network traffic. This is only possible with very specific (and unlikely) application layer code. [!NOTE] This does not impact your application if you are using Declarative Mode. This only impacts Framework Mode and Data Mode applications doing manual SSR/hydration
Recommended action: Upgrade to 7.18.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Certain CSRF checks in React Router v7 Framework Mode were insufficient and run on POST requests, but were bypassed on PUT/PATCH/DELETE requests. This is a low severity vulnerability because modern browser protections (CORS preflight, SameSite cookies) already block the cross-origin attack vectors that this missing CSRF check would otherwise gate. [!NOTE] This does not impact your React Router application if you are using Declarative Mode (<BrowserRouter) or Data Mode (createBrowserRouter/<RouterProvider).
Recommended action: Upgrade to 7.15.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
A DoS vulnerability exists in the React Router v7 Framework Mode, as well as Remix v2.9.0+ with Single Fetch enabled. In some scenarios the underlying serialization algorithm can become a bottleneck when encoding specific types of data into server responses. Please upgrade to React Router v7.14.0 or later. [!NOTE] This does not impact your React Router application if you are using Declarative Mode (<BrowserRouter) or Data Mode (createBrowserRouter/<RouterProvider).
Recommended action: Upgrade to 7.14.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
There exists a potential DOS attack vector in React Router Framework Mode applications (as well as Remix v2.10.0 - 2.17.4). Certain requests can be crafted to consume disproportionate resources on the server, resulting in response time degredation and/or service unavailability for end users. [!NOTE] This does not impact your React Router application if you are using Declarative Mode (<BrowserRouter) or Data Mode (createBrowserRouter/<RouterProvider).
Recommended action: Upgrade to 7.15.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
When using React Router v7 in Framework Mode, there exists a combination of steps that could potentially allow unauthorized RCE through external requests. This first requires the application code to have an existing prototype pollution vulnerability. This can be leveraged into a 2-step attack in which the second step can trigger unauthorized RCE on the remote server. [!NOTE] This does not impact your React Router application if you are using Declarative Mode (<BrowserRouter) or Data Mode (createBrowserRouter/<RouterProvider).
Recommended action: Upgrade to 7.14.2 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Certain URLs passed to the redirect function can trigger an open redirect to an external domain depending on the level of validation done by the application prior to returning the redirect. [!NOTE] This does not impact your React Router application if you are using Declarative Mode (<BrowserRouter)
Recommended action: Upgrade to 7.14.1 or 6.30.4 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
When using React Router v7's unstable RSC APIs, there exists a potential client-side XSS issue in the RSC redirect handling if redirects are coming from untrusted sources [!NOTE] This only impacts your application if you are using the unstable RSC APIs in React Router.
Recommended action: Upgrade to 7.13.2 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
When using React Router v7 Framework Mode with Pre-rendering enabled, an improper neutralization of the HTTP Location header value can permit Cross-Site Scripting (XSS) in statically generated HTML files if the redirect location comes from an untrusted source. [!NOTE] This does not impact your React Router application if you are using Declarative Mode (<BrowserRouter) or Data Mode (createBrowserRouter/<RouterProvider).
Recommended action: Upgrade to 7.13.2 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
React Router (or Remix v2) is vulnerable to CSRF attacks on document POST requests to UI routes when using server-side route action handlers in Framework Mode, or when using React Server Actions in the new unstable RSC modes. [!NOTE] This does not impact your application if you are using Declarative Mode (<BrowserRouter) or Data Mode (createBrowserRouter/<RouterProvider).
Recommended action: Upgrade to 7.12.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
React Router (and Remix v1/v2) SPA open navigation redirects originating from loaders or actions in Framework Mode, Data Mode, or the unstable RSC modes can result in unsafe URLs causing unintended javascript execution on the client. This is only an issue if developers are creating redirect paths from untrusted content or via an open redirect. [!NOTE] This does not impact applications that use Declarative Mode (<BrowserRouter).
Recommended action: Upgrade to 7.12.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
A XSS vulnerability exists in in React Router's <ScrollRestoration API in Framework Mode when using the getKey/storageKey props during Server-Side Rendering which could allow arbitrary JavaScript execution during SSR if untrusted content is used to generate the keys. [!NOTE] This does not impact applications if developers have disabled server-side rendering in Framework Mode, or if they are using Declarative Mode (<BrowserRouter) or Data Mode (createBrowserRouter/<RouterProvider).
Recommended action: Upgrade to 7.12.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
An attacker-supplied path can be crafted so that when a React Router application navigates to it via navigate(), <Link, or redirect(), the app performs a navigation/redirect to an external URL. This is only an issue if developers pass untrusted content into navigation paths in their application code.
Recommended action: Upgrade to 7.9.6 or 6.30.2 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
A XSS vulnerability exists in in React Router's meta()/<Meta APIs in Framework Mode when generating script:ld+json tags which could allow arbitrary JavaScript execution during SSR if untrusted content is used to generate the tag. [!NOTE] This does not impact applications using Declarative Mode (<BrowserRouter) or Data Mode (createBrowserRouter/<RouterProvider).
Recommended action: Upgrade to 7.9.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
After some research, it turns out that it's possible to modify pre-rendered data by adding a header to the request. This allows to completely spoof its contents and modify all the values of the data object passed to the HTML. Latest versions are impacted. Details The vulnerable header is X-React-Router-Prerender-Data, a specific JSON object must be passed to it in order for the spoofing to be successful as we will see shortly. Here is the vulnerable code : <img width="776" alt="Capture d’écran 2025-04-07 à 05 36 58" src="https://github.com/user-attachments/assets/c95b0b33-15ce-4d30-9f5e-b10525dd6ab4" / To use the header, React-router must be used in Framework mode, and for the attack to be possible the target page must use a loader. Steps to reproduce Versions used for our PoC: - "@react-router/node": "^7.5.0", - "@react-router/serve": "^7.5.0", - "react": "^19.0.0" - "react-dom": "^19.0.0" - "react-router": "^7.5.0" 1. Install React-Router with its default configuration…
Recommended action: Upgrade to 7.5.2 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
After some research, it turns out that it is possible to force an application to switch to SPA mode by adding a header to the request. If the application uses SSR and is forced to switch to SPA, this causes an error that completely corrupts the page. If a cache system is in place, this allows the response containing the error to be cached, resulting in a cache poisoning that strongly impacts the availability of the application. Details The vulnerable header is X-React-Router-SPA-Mode; adding it to a request sent to a page/endpoint using a loader throws an error. Here is the vulnerable code : <img width="672" alt="Capture d’écran 2025-04-07 à 08 28 20" src="https://github.com/user-attachments/assets/0a0e9c41-70fd-4dba-9061-892dd6797291" / To use the header, React-router must be used in Framework mode, and for the attack to be possible the target page must use a loader. Steps to reproduce Versions used for our PoC: - "@react-router/node": "^7.5.0", - "@react-router/serve":…
Recommended action: Upgrade to 7.5.2 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.