Security
فارسی
All products

react-router

npm · Package
20 reports
Vulnerability alerts
Follow
ReportProductEcosystemSeverityFix statusLast updated
React Router: Open redirect via backslash in <Link> and useNavigate (CVE-2025-68470 bypass)CVE-2026-53669 · GHSA-WRJC-X8RR-H8H6 react-routerCryostat 4/cryostat-openshift-console-plugin-npm npmRed Hat Medium Fix reported
React Router: Unauthenticated Denial of Service via Inefficient Route MatchingCVE-2026-55685 · GHSA-CHX6-HX7R-MCP5 react-routerExploit Intelligence/exploit-intelligence-tech-preview/agent-client-rhel9 npmRed Hat High Fix reported
React Router: Potential CSRF via PUT/PATCH/DELETE document requestsCVE-2026-53663 · GHSA-84G9-W2XQ-VCV6 @remix-run/server-runtimereact-router npmRed Hat Low Fix reported
React Router's same-origin redirect with path starting // causes open redirect via protocol-relative URL reinterpretationCVE-2026-40181 · GHSA-2J2X-HQR9-3H42 @remix-run/routerreact-router npmRed Hat Medium Fix reported
React Router: RSC Mode CSRF Bypass Allows Action Execution Before 400 ResponseGHSA-QWWW-VCR4-C8H2 react-router npm High Fix reported
React Router: RSCErrorHandler Missing Protocol Validation (XSS)CVE-2026-53667 · GHSA-H8FP-F39C-Q6MH react-routerExploit Intelligence/exploit-intelligence-tech-preview/agent-client-rhel9 npmRed Hat Medium Fix reported
React Router: Arbitrary Constructor Injection via deserializeErrors() in React Router SSR HydrationCVE-2026-53666 · GHSA-337J-9HXR-RHXG react-routerCryostat 4/cryostat-openshift-console-plugin-npm npmRed Hat Medium Fix reported
React Router vulnerable to DoS via unbounded path expansion in __manifest endpointCVE-2026-42342 · GHSA-8X6R-G9MW-2R78 @remix-run/server-runtimereact-router npmRed Hat High Fix reported
React Router's vendored turbo-stream v2 allows arbitrary constructor invocation via TYPE_ERROR deserialization leading to Unauth RCECVE-2026-42211 · GHSA-49RJ-9FVP-4H2H react-routerOpenShift Pipelines/openshift-pipelines/pipelines-console-plugin-rhel9 npmRed Hat High Fix reported
React Router has CSRF issue in Action/Server Action Request ProcessingCVE-2026-22030 · GHSA-H5CW-625J-3RXH @remix-run/server-runtimereact-router npmRed Hat Medium Fix reported
React Router has XSS VulnerabilityCVE-2025-59057 · GHSA-3CGP-3XVW-98X8 @remix-run/reactreact-router npm High Fix reported
React Router SSR XSS in ScrollRestorationCVE-2026-21884 · GHSA-8V8X-CX79-35W7 @remix-run/reactreact-router npm High Fix reported
React Router has stored XSS via unescaped Location header in prerendered redirect HTMLCVE-2026-33244 · GHSA-F22V-GFQF-P8F3 react-routerCryostat 4/cryostat-openshift-console-plugin-npm npmRed Hat Medium Fix reported
React Router: Open redirect leading to XSSCVE-2026-53668 · GHSA-JJMJ-JMHJ-QWJ2 react-router-domreact-router npmRed Hat Medium Fix reported
React Router vulnerable to Denial of Service via reflected user input in single-fetchCVE-2026-34077 · GHSA-RXV8-25V2-QMQ8 react-routerturbo-stream npmRed Hat High Fix reported
React Router vulnerable to XSS in unstable RSC redirect handling via javascript: redirect targetsCVE-2026-33245 · GHSA-8646-J5J9-6R62 react-routerExploit Intelligence/exploit-intelligence-tech-preview/agent-client-rhel9 npmRed Hat High Fix reported
React Router vulnerable to XSS via Open RedirectsCVE-2026-22029 · GHSA-2W69-QVJG-HVJX @remix-run/routerreact-router npmRed Hat High Fix reported
React Router has unexpected external redirect via untrusted pathsCVE-2025-68470 · GHSA-9JCX-V3WJ-WH4M react-routerCryostat 4/io.cryostat-cryostat npmRed Hat Medium Fix reported
React Router allows pre-render data spoofing on React-Router framework modeCVE-2025-43865 · GHSA-CPJ6-FHP6-MR6J react-routerRed Hat OpenShift AI (RHOAI)/rhoai/odh-dashboard-rhel8 npmRed Hat High Fix reported
React Router allows a DoS via cache poisoning by forcing SPA modeCVE-2025-43864 · GHSA-F46R-RW29-R322 react-router npm High Fix reported