{"kind": "product", "path": "vulns/npm/react-router", "name": "react-router", "product": "react-router", "ecosystem": "npm", "items": [{"id": "CVE-2026-53669", "noindex": false, "published": "2026-07-27T22:11:39.056Z", "modified": "2026-07-28T16:04:33.480Z", "cvss": 5.1, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:L/SI:L/SA:N", "severity": "medium", "epss": 0.00319, "kev": false, "exploits": [], "stacks": [{"name": "node", "path": "vulns/stack/node", "slug": "node"}], "path": "vulns/cve-2026-53669", "title": "React Router: Open redirect via backslash in <Link> and useNavigate (CVE-2025-68470 bypass)", "description": "React Router is a router for React. Versions 6.0.0 through 7.17.0 are vulnerable to Open Redirtect through use of backslashes in <Link> and useNavigate. This issue is a follow up to CVE-2025-68470 and has been fixed in version 7.18.0.", "references": ["https://github.com/remix-run/react-router/security/advisories/GHSA-wrjc-x8rr-h8h6", "https://github.com/remix-run/react-router/pull/15176", "https://github.com/remix-run/react-router/blob/main/CHANGELOG.md#v7180"], "fixes": ["7.18.0"], "products": [{"name": "react-router", "path": "vulns/npm/react-router", "ecosystem": "npm"}]}, {"id": "CVE-2026-55685", "noindex": false, "published": "2026-07-27T21:45:57.751Z", "modified": "2026-07-28T13:40:04.996Z", "cvss": 8.7, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "severity": "high", "epss": 0.00708, "kev": false, "exploits": [], "stacks": [{"name": "node", "path": "vulns/stack/node", "slug": "node"}], "path": "vulns/cve-2026-55685", "title": "React Router: Unauthenticated Denial of Service via Inefficient Route Matching", "description": "React Router is a router for React. In versions 7.0.0 through 7.17.0, the manifest endpoint could be accessed via unauthenticated targeted requests that would put heavy load on the server and slow down response times. This issue is a follow up to CVE-2026-42342, and does not does not impact React Router applications using Declarative Mode (<BrowserRouter>) or Data Mode (createBrowserRouter/<RouterProvider>). This issue has been fixed in version 7.18.0.", "references": ["https://github.com/remix-run/react-router/security/advisories/GHSA-chx6-hx7r-mcp5", "https://github.com/remix-run/react-router/security/advisories/GHSA-8x6r-g9mw-2r78", "https://github.com/remix-run/react-router/pull/15186"], "fixes": ["7.18.0"], "products": [{"name": "react-router", "path": "vulns/npm/react-router", "ecosystem": "npm"}]}, {"id": "CVE-2026-53668", "noindex": false, "published": "2026-07-27T21:42:17.641Z", "modified": "2026-07-28T13:44:11.335Z", "cvss": 6.9, "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:L/A:N", "severity": "medium", "epss": 0.00341, "kev": false, "exploits": [], "stacks": [{"name": "node", "path": "vulns/stack/node", "slug": "node"}], "path": "vulns/cve-2026-53668", "title": "React Router: Open redirect can lead to XSS", "description": "React Router is a router for React. In versions 6.30.2 through 6.30.4 and 7.9.6 through 7.12.0, applications that allow open redirects are vulnerable to XSS. An attacker could craft a malicious link that redirects users to an unexpected external site or that exploits an XSS vector.This issue has been fixed in version 7.13.0.", "references": ["https://github.com/remix-run/react-router/security/advisories/GHSA-jjmj-jmhj-qwj2", "https://github.com/remix-run/react-router/pull/14718", "https://github.com/remix-run/react-router/commit/3a5b5ad0e5cf9918c646509563f5c41a89226ff3"], "fixes": ["7.13.0"], "products": [{"name": "react-router", "path": "vulns/npm/react-router", "ecosystem": "npm"}]}, {"id": "CVE-2026-53667", "noindex": false, "published": "2026-07-27T21:21:16.084Z", "modified": "2026-07-28T13:51:15.333Z", "cvss": 6.9, "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:L/A:N", "severity": "medium", "epss": 0.00355, "kev": false, "exploits": [], "stacks": [{"name": "node", "path": "vulns/stack/node", "slug": "node"}], "path": "vulns/cve-2026-53667", "title": "React Router: Cross-site Scripting is Possible due to Missing RSCErrorHandler Protocol Validation (Incomplete fix for CVE-2026-53667)", "description": "React Router is a router for React. In versions 7.11.0 through 7.17.0, the RSCErrorHandler is missing protocol validation, allowing for redirects from untrusted sources. This issue is a follow up to CVE-2026-53667, and only affects consuming applications if they are using the unstable RSC APIs. This issue has been fixed in version 7.18.0.", "references": ["https://github.com/remix-run/react-router/security/advisories/GHSA-h8fp-f39c-q6mh", "https://github.com/remix-run/react-router/pull/15177", "https://github.com/remix-run/react-router/commit/ce596e823f0d7b883a433af1d5a839a8b9fe0242"], "fixes": ["7.18.0"], "products": [{"name": "react-router", "path": "vulns/npm/react-router", "ecosystem": "npm"}]}, {"id": "CVE-2026-53666", "noindex": false, "published": "2026-07-27T21:14:49.547Z", "modified": "2026-07-28T15:19:58.603Z", "cvss": 6.1, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "severity": "medium", "epss": 0.0042, "kev": false, "exploits": [], "stacks": [{"name": "node", "path": "vulns/stack/node", "slug": "node"}], "path": "vulns/cve-2026-53666", "title": "React Router: Arbitrary Constructor Injection via deserializeErrors() in React Router SSR Hydration", "description": "React Router is a router for React. In versions 6.4.0 through 7.17.0, if application code was written in a way that allows attacker-supplied input to overwrite certain aspects of errors caught by the SSR process, then it was possible for an attacker to trigger unexpected constructor execution on the client, which would in turn trigger an outbound network request. This is only possible with very specific (and unlikely) application-layer code. Note that this does not impact an application if it is using Declarative Mode. It only impacts Framework Mode and Data Mode applications that perform manual SSR/hydration. This issue has been fixed in ver", "references": ["https://github.com/remix-run/react-router/security/advisories/GHSA-337j-9hxr-rhxg", "https://github.com/remix-run/react-router/pull/15175", "https://github.com/remix-run/react-router/commit/9d22943fd46c8ae4b08236425fa3549e10e9ad1a"], "fixes": ["7.18.0"], "products": [{"name": "react-router", "path": "vulns/npm/react-router", "ecosystem": "npm"}]}, {"id": "GHSA-qwww-vcr4-c8h2", "noindex": false, "published": "2026-07-24T16:44:43Z", "modified": "2026-09-10T03:50:52.955441840Z", "cvss": 7.1, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N", "severity": "high", "epss": null, "kev": false, "exploits": [], "stacks": [{"name": "node", "path": "vulns/stack/node", "slug": "node"}], "path": "vulns/ghsa-qwww-vcr4-c8h2", "title": "React Router: RSC Mode CSRF Bypass Allows Action Execution Before 400 Response", "description": "This is a follow up to CVE-2026-22030 to address related CSRF flows in unstable RSC code paths.\n\n> [!NOTE]\n> This only affects your application if you are using the unstable RSC APIs", "references": ["https://github.com/remix-run/react-router/security/advisories/GHSA-qwww-vcr4-c8h2", "https://github.com/remix-run/react-router/pull/15353", "https://github.com/remix-run/react-router/commit/7a71c728ad116bd78699a258b2014ce9585729f5"], "fixes": ["7.18.2", "8.3.0"], "products": [{"name": "react-router", "path": "vulns/npm/react-router", "ecosystem": "npm"}, {"name": "react-router", "path": "vulns/npm/react-router", "ecosystem": "npm"}]}, {"id": "CVE-2026-53663", "noindex": false, "published": "2026-06-22T17:39:29.160Z", "modified": "2026-06-22T19:52:50.287Z", "cvss": 3.1, "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N", "severity": "low", "epss": 0.00148, "kev": false, "exploits": [], "stacks": [{"name": "node", "path": "vulns/stack/node", "slug": "node"}], "path": "vulns/cve-2026-53663", "title": "React Router: `handleDocumentRequest` CSRF check covers `POST` only; PUT/PATCH/DELETE bypass", "description": "React Router is a router for React. From 7.12.0 until 7.15.1, certain CSRF checks in React Router v7 Framework Mode were insufficient and run on POST requests, but were bypassed on PUT/PATCH/DELETE requests. This is a low severity vulnerability because modern browser protections (CORS preflight, SameSite cookies) already block the cross-origin attack vectors that this missing CSRF check would otherwise gate. This vulnerability is fixed in 7.15.1.", "references": ["https://github.com/remix-run/react-router/security/advisories/GHSA-84g9-w2xq-vcv6", "https://nvd.nist.gov/vuln/detail/CVE-2026-53663"], "fixes": ["7.15.1"], "products": [{"name": "react-router", "path": "vulns/npm/react-router", "ecosystem": "npm"}]}, {"id": "CVE-2026-42342", "noindex": false, "published": "2026-06-02T18:23:02.765Z", "modified": "2026-06-03T13:52:43.400Z", "cvss": 7.5, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "severity": "high", "epss": 0.00299, "kev": false, "exploits": [], "stacks": [{"name": "node", "path": "vulns/stack/node", "slug": "node"}], "path": "vulns/cve-2026-42342", "title": "React Router vulnerable to DoS via unbounded path expansion in __manifest endpoint", "description": "React Router is a router for React. In versions 7.0.0 through 7.14.x of react-router and versions 2.10.0 through 2.17.4 of @remix-run/server-runtime, certain crafted requests can consume disproportionate server resources via unbounded path expansion in the __manifest endpoint, resulting in response time degradation and/or service unavailability for end users. This affects React Router Framework Mode applications as well as Remix applications. This does not impact applications using Declarative Mode (`<BrowserRouter>`) or Data Mode (`createBrowserRouter/<RouterProvider>`). This is patched in react-router version 7.15.0 and @remix-run/server-ru", "references": ["https://github.com/remix-run/react-router/security/advisories/GHSA-8x6r-g9mw-2r78", "https://nvd.nist.gov/vuln/detail/CVE-2026-42342"], "fixes": ["7.15.0"], "products": [{"name": "react-router", "path": "vulns/npm/react-router", "ecosystem": "npm"}]}, {"id": "CVE-2026-42211", "noindex": false, "published": "2026-06-02T18:18:46.706Z", "modified": "2026-06-03T14:08:30.154Z", "cvss": 8.1, "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "severity": "high", "epss": 0.00416, "kev": false, "exploits": [], "stacks": [{"name": "node", "path": "vulns/stack/node", "slug": "node"}], "path": "vulns/cve-2026-42211", "title": "React Router's vendored turbo-stream v2 allows arbitrary constructor invocation via TYPE_ERROR deserialization leading to Unauth RCE", "description": "React Router is a router for React. In versions 7.0.0 through 7.14.1, when using Framework Mode, a combination of steps could potentially allow unauthorized remote code execution (RCE) through external requests. This attack requires the application code to have an existing prototype pollution vulnerability, which can then be leveraged in a 2-step attack where the second step triggers unauthorized RCE on the remote server. This does not impact applications using Declarative Mode (`<BrowserRouter>`) or Data Mode (`createBrowserRouter/<RouterProvider>`). This is patched in version 7.14.2.", "references": ["https://github.com/remix-run/react-router/security/advisories/GHSA-49rj-9fvp-4h2h", "https://nvd.nist.gov/vuln/detail/CVE-2026-42211"], "fixes": ["7.14.2"], "products": [{"name": "react-router", "path": "vulns/npm/react-router", "ecosystem": "npm"}]}, {"id": "CVE-2026-40181", "noindex": false, "published": "2026-06-02T17:55:09.919Z", "modified": "2026-08-04T21:26:41.037Z", "cvss": 6.6, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:U", "severity": "medium", "epss": 0.00221, "kev": false, "exploits": [], "stacks": [{"name": "node", "path": "vulns/stack/node", "slug": "node"}], "path": "vulns/cve-2026-40181", "title": "React Router's same-origin redirect with path starting // causes open redirect via protocol-relative URL reinterpretation", "description": "React Router is a router for React. In versions 7.0.0 through 7.14.0 and 6.7.0 through 6.30.3, certain URLs passed to the redirect function can trigger an open redirect to an external domain due to path values starting with // being reinterpreted as protocol-relative URLs. The level of impact depends on the validation done by the application prior to returning the redirect. This does not impact applications using Declarative Mode (<BrowserRouter>). This is patched in versions 7.14.1 and 6.30.4.", "references": ["https://github.com/remix-run/react-router/security/advisories/GHSA-2j2x-hqr9-3h42", "https://nvd.nist.gov/vuln/detail/CVE-2026-40181"], "fixes": ["6.30.4", "7.14.1"], "products": [{"name": "react-router", "path": "vulns/npm/react-router", "ecosystem": "npm"}, {"name": "react-router", "path": "vulns/npm/react-router", "ecosystem": "npm"}]}, {"id": "CVE-2026-34077", "noindex": false, "published": "2026-06-02T17:31:35.579Z", "modified": "2026-06-03T13:19:02.279Z", "cvss": 7.5, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "severity": "high", "epss": 0.00294, "kev": false, "exploits": [], "stacks": [{"name": "node", "path": "vulns/stack/node", "slug": "node"}], "path": "vulns/cve-2026-34077", "title": "React Router vulnerable to Denial of Service via reflected user input in single-fetch", "description": "React Router is a router for React. In versions 7.7.0 through 7.13.1, when using React Router's unstable React Server Components (RSC) APIs, there is a potential client-side Cross-Site Scripting (XSS) vulnerability in the RSC redirect handling if redirects come from untrusted sources. This does not impact applications that are not using the unstable RSC APIs in React Router. This is patched in version 7.13.2.", "references": ["https://github.com/remix-run/react-router/security/advisories/GHSA-rxv8-25v2-qmq8", "https://nvd.nist.gov/vuln/detail/CVE-2026-34077"], "fixes": ["7.14.0"], "products": [{"name": "react-router", "path": "vulns/npm/react-router", "ecosystem": "npm"}]}, {"id": "CVE-2026-33245", "noindex": false, "published": "2026-06-02T17:14:50.377Z", "modified": "2026-06-03T19:09:34.483Z", "cvss": 8, "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:N", "severity": "high", "epss": 0.00189, "kev": false, "exploits": [], "stacks": [{"name": "node", "path": "vulns/stack/node", "slug": "node"}], "path": "vulns/cve-2026-33245", "title": "React Router vulnerable to XSS in unstable RSC redirect handling via javascript: redirect targets", "description": "React Router is a router for React. In versions 7.7.0 through 7.13.1, when using React Router's unstable React Server Components (RSC) APIs, there is a potential client-side Cross-Site Scripting (XSS) vulnerability in the RSC redirect handling if redirects come from untrusted sources. This does not impact applications that are not using the unstable RSC APIs in React Router. This is patched in version 7.13.2.", "references": ["https://github.com/remix-run/react-router/security/advisories/GHSA-8646-j5j9-6r62", "https://nvd.nist.gov/vuln/detail/CVE-2026-33245"], "fixes": ["7.13.2"], "products": [{"name": "react-router", "path": "vulns/npm/react-router", "ecosystem": "npm"}]}, {"id": "CVE-2026-33244", "noindex": false, "published": "2026-06-02T16:59:31.104Z", "modified": "2026-06-02T17:28:13.207Z", "cvss": 5.4, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "severity": "medium", "epss": 0.00144, "kev": false, "exploits": [], "stacks": [{"name": "node", "path": "vulns/stack/node", "slug": "node"}], "path": "vulns/cve-2026-33244", "title": "React Router has stored XSS via unescaped Location header in prerendered redirect HTML", "description": "React Router is a router for React. In versions 7.5.1 through 7.13.1, when using Framework Mode with pre-rendering enabled, improper neutralization of the HTTP `Location` header value can permit Cross-Site Scripting (XSS) in the statically generated HTML files if the redirect location comes from an untrusted source. This does not impact applications using Declarative Mode (`<BrowserRouter>`) or Data Mode (`createBrowserRouter/<RouterProvider>`). This is patched in version 7.13.2.", "references": ["https://github.com/remix-run/react-router/security/advisories/GHSA-f22v-gfqf-p8f3", "https://nvd.nist.gov/vuln/detail/CVE-2026-33244"], "fixes": ["7.13.2"], "products": [{"name": "react-router", "path": "vulns/npm/react-router", "ecosystem": "npm"}]}, {"id": "CVE-2026-22030", "noindex": false, "published": "2026-01-10T02:42:44.603Z", "modified": "2026-01-12T18:09:39.441Z", "cvss": 6.5, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N", "severity": "medium", "epss": 0.00186, "kev": false, "exploits": [], "stacks": [{"name": "node", "path": "vulns/stack/node", "slug": "node"}], "path": "vulns/cve-2026-22030", "title": "React Router has CSRF issue in Action/Server Action Request Processing", "description": "React Router is a router for React. In @remix-run/server-runtime version prior to 2.17.3. and react-router 7.0.0 through 7.11.0, React Router (or Remix v2) is vulnerable to CSRF attacks on document POST requests to UI routes when using server-side route action handlers in Framework Mode, or when using React Server Actions in the new unstable RSC modes. There is no impact if Declarative Mode (<BrowserRouter>) or Data Mode (createBrowserRouter/<RouterProvider>) is being used. This issue has been patched in @remix-run/server-runtime version 2.17.3 and react-router version 7.12.0.", "references": ["https://github.com/remix-run/react-router/security/advisories/GHSA-h5cw-625j-3rxh", "https://nvd.nist.gov/vuln/detail/CVE-2026-22030"], "fixes": ["7.12.0"], "products": [{"name": "react-router", "path": "vulns/npm/react-router", "ecosystem": "npm"}]}, {"id": "CVE-2026-22029", "noindex": false, "published": "2026-01-10T02:42:32.736Z", "modified": "2026-09-10T12:04:57.289Z", "cvss": 8, "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:N", "severity": "high", "epss": 0.00866, "kev": false, "exploits": [], "stacks": [{"name": "node", "path": "vulns/stack/node", "slug": "node"}], "path": "vulns/cve-2026-22029", "title": "React Router vulnerable to XSS via Open Redirects", "description": "React Router is a router for React. In @remix-run/router version prior to 1.23.2 and react-router 7.0.0 through 7.11.0, React Router (and Remix v1/v2) SPA open navigation redirects originating from loaders or actions in Framework Mode, Data Mode, or the unstable RSC modes can result in unsafe URLs causing unintended javascript execution on the client. This is only an issue if you are creating redirect paths from untrusted content or via an open redirect. There is no impact if Declarative Mode (<BrowserRouter>) is being used. This issue has been patched in @remix-run/router version 1.23.2 and react-router version 7.12.0.", "references": ["https://github.com/remix-run/react-router/security/advisories/GHSA-2w69-qvjg-hvjx", "https://access.redhat.com/security/cve/CVE-2026-22029", "https://bugzilla.redhat.com/show_bug.cgi?id=2428412"], "fixes": ["7.12.0"], "products": [{"name": "react-router", "path": "vulns/npm/react-router", "ecosystem": "npm"}]}, {"id": "CVE-2026-21884", "noindex": false, "published": "2026-01-10T02:41:44.944Z", "modified": "2026-07-15T01:19:46.847Z", "cvss": 8.2, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N", "severity": "high", "epss": 0.00531, "kev": false, "exploits": [], "stacks": [{"name": "node", "path": "vulns/stack/node", "slug": "node"}], "path": "vulns/cve-2026-21884", "title": "React Router SSR XSS in ScrollRestoration", "description": "React Router is a router for React. In @remix-run/react version prior to 2.17.3. and react-router 7.0.0 through 7.11.0, a XSS vulnerability exists in in React Router's <ScrollRestoration> API in Framework Mode when using the getKey/storageKey props during Server-Side Rendering which could allow arbitrary JavaScript execution during SSR if untrusted content is used to generate the keys. There is no impact if server-side rendering in Framework Mode is disabled, or if Declarative Mode (<BrowserRouter>) or Data Mode (createBrowserRouter/<RouterProvider>) is being used. This issue has been patched in @remix-run/react version 2.17.3 and react-route", "references": ["https://github.com/remix-run/react-router/security/advisories/GHSA-8v8x-cx79-35w7", "https://access.redhat.com/security/cve/CVE-2026-21884", "https://bugzilla.redhat.com/show_bug.cgi?id=2428421"], "fixes": ["7.12.0"], "products": [{"name": "react-router", "path": "vulns/npm/react-router", "ecosystem": "npm"}]}, {"id": "CVE-2025-59057", "noindex": false, "published": "2026-01-10T02:40:25.142Z", "modified": "2026-07-15T01:25:51.670Z", "cvss": 7.6, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N", "severity": "high", "epss": 0.00503, "kev": false, "exploits": [], "stacks": [{"name": "node", "path": "vulns/stack/node", "slug": "node"}], "path": "vulns/cve-2025-59057", "title": "React Router has XSS Vulnerability", "description": "React Router is a router for React. In @remix-run/react versions 1.15.0 through 2.17.0. and react-router versions 7.0.0 through 7.8.2, a XSS vulnerability exists in in React Router's meta()/<Meta> APIs in Framework Mode when generating script:ld+json tags which could allow arbitrary JavaScript execution during SSR if untrusted content is used to generate the tag. There is no impact if the application is being used in Declarative Mode (<BrowserRouter>) or Data Mode (createBrowserRouter/<RouterProvider>). This issue has been patched in @remix-run/react version 2.17.1 and react-router version 7.9.0.", "references": ["https://github.com/remix-run/react-router/security/advisories/GHSA-3cgp-3xvw-98x8", "https://access.redhat.com/security/cve/CVE-2025-59057", "https://bugzilla.redhat.com/show_bug.cgi?id=2428426"], "fixes": ["7.9.0"], "products": [{"name": "react-router", "path": "vulns/npm/react-router", "ecosystem": "npm"}]}, {"id": "CVE-2025-68470", "noindex": false, "published": "2026-01-10T02:39:41.078Z", "modified": "2026-01-12T18:17:43.794Z", "cvss": 6.5, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "severity": "medium", "epss": 0.00492, "kev": false, "exploits": [], "stacks": [{"name": "node", "path": "vulns/stack/node", "slug": "node"}], "path": "vulns/cve-2025-68470", "title": "React Router has unexpected external redirect via untrusted paths", "description": "React Router is a router for React. In versions 6.0.0 through 6.30.1 and 7.0.0 through 7.9.5, an attacker-supplied path can be crafted so that when a React Router application navigates to it via navigate(), <Link>, or redirect(), the app performs a navigation/redirect to an external URL. This is only an issue if you are passing untrusted content into navigation paths in your application code. This issue has been patched in versions 6.30.2 and 7.9.6.", "references": ["https://github.com/remix-run/react-router/security/advisories/GHSA-9jcx-v3wj-wh4m", "https://nvd.nist.gov/vuln/detail/CVE-2025-68470"], "fixes": ["6.30.2", "7.9.6"], "products": [{"name": "react-router", "path": "vulns/npm/react-router", "ecosystem": "npm"}, {"name": "react-router", "path": "vulns/npm/react-router", "ecosystem": "npm"}]}, {"id": "CVE-2025-43865", "noindex": false, "published": "2025-04-25T00:18:53.222Z", "modified": "2025-04-25T15:16:00.202Z", "cvss": 8.2, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H", "severity": "high", "epss": 0.00815, "kev": false, "exploits": [], "stacks": [{"name": "node", "path": "vulns/stack/node", "slug": "node"}], "path": "vulns/cve-2025-43865", "title": "React Router allows pre-render data spoofing on React-Router framework mode", "description": "React Router is a router for React. In versions on the 7.0 branch prior to version 7.5.2, it's possible to modify pre-rendered data by adding a header to the request. This allows to completely spoof its contents and modify all the values ​​of the data object passed to the HTML. This issue has been patched in version 7.5.2.", "references": ["https://github.com/remix-run/react-router/security/advisories/GHSA-cpj6-fhp6-mr6j", "https://github.com/remix-run/react-router/commit/c84302972a152d851cf5dd859ff332b354b70111", "https://github.com/remix-run/react-router/blob/e6c53a0130559b4a9bd47f9cf76ea5b08a69868a/packages/react-router/lib/server-runtime/routes.ts#L87"], "fixes": ["7.5.2"], "products": [{"name": "react-router", "path": "vulns/npm/react-router", "ecosystem": "npm"}]}, {"id": "CVE-2025-43864", "noindex": false, "published": "2025-04-25T00:18:16.058Z", "modified": "2025-04-25T15:18:38.495Z", "cvss": 7.5, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "severity": "high", "epss": 0.20475, "kev": false, "exploits": ["public-poc"], "stacks": [{"name": "node", "path": "vulns/stack/node", "slug": "node"}], "path": "vulns/cve-2025-43864", "title": "React Router allows a DoS via cache poisoning by forcing SPA mode", "description": "React Router is a router for React. Starting in version 7.2.0 and prior to version 7.5.2, it is possible to force an application to switch to SPA mode by adding a header to the request. If the application uses SSR and is forced to switch to SPA, this causes an error that completely corrupts the page. If a cache system is in place, this allows the response containing the error to be cached, resulting in a cache poisoning that strongly impacts the availability of the application. This issue has been patched in version 7.5.2.", "references": ["https://github.com/remix-run/react-router/security/advisories/GHSA-f46r-rw29-r322", "https://github.com/remix-run/react-router/commit/c84302972a152d851cf5dd859ff332b354b70111", "https://github.com/remix-run/react-router/blob/e6c53a0130559b4a9bd47f9cf76ea5b08a69868a/packages/react-router/lib/server-runtime/server.ts#L407"], "fixes": ["7.5.2"], "products": [{"name": "react-router", "path": "vulns/npm/react-router", "ecosystem": "npm"}]}], "total": 20, "unknown_count": 0, "release_unconfirmed": false, "page": 1, "pages": 1, "filtered": false, "noindex": false, "filters": {}, "page_size": 20, "products": [{"name": "react-router", "path": "vulns/npm/react-router", "ecosystem": "npm"}], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}, {"name": "web", "path": "vulns/stack/web", "slug": "web"}, {"name": "php", "path": "vulns/stack/php", "slug": "php"}, {"name": "python", "path": "vulns/stack/python", "slug": "python"}, {"name": "node", "path": "vulns/stack/node", "slug": "node"}, {"name": "database", "path": "vulns/stack/database", "slug": "database"}, {"name": "containers", "path": "vulns/stack/containers", "slug": "containers"}, {"name": "network", "path": "vulns/stack/network", "slug": "network"}, {"name": "applications", "path": "vulns/stack/applications", "slug": "applications"}], "versions": [], "stats": {"recent": 0, "kev": 0}, "lastmod": "2026-09-10T12:04:57.289Z", "early_advisories": [], "license": "Sie dürfen die Auswahl von PatchFirst und unsere Ergänzungen (Prioritäten, Frühwarnungen, Texte, Zusammenfassungen und Aggregate) für eigene Zwecke einschließlich interner geschäftlicher Aufgaben frei nutzen. Weiterverkauf, kommerzielle Verbreitung und massenhafte Spiegelung dieser Auswahl oder Ergänzungen erfordern eine schriftliche Vereinbarung mit dem Betreiber. Nennen Sie bei jeder Nutzung oder Veröffentlichung der Auswahl oder unserer Ergänzungen PatchFirst (https://patchfirst.dev/vulns/) mit diesem Link zur Feedseite Ihrer Region als Quelle. Originaleinträge aus offenen Quellen unterliegen weiterhin ihren jeweiligen Lizenzen und Bedingungen. Diese Bedingungen beschränken Ihre Rechte an den Originaldaten nicht, die Sie direkt bei den Quellen beziehen können.", "terms_url": "https://patchfirst.dev/de/vulns/#feed-terms", "attribution": {"name": "PatchFirst", "url": "https://patchfirst.dev/vulns/"}, "source_changes": "PatchFirst wählt Einträge aus, normalisiert und kombiniert sie; Zusammenfassungen und Übersetzungen können hinzukommen. Nachrichten werden im jeweiligen Eintrag mit einem Link zur Originalquelle belegt.", "sources": [{"id": "cve", "name": "CVE List / CVE.org", "url": "https://www.cve.org/", "license": "CVE Terms of Use", "terms_url": "https://www.cve.org/Legal/TermsOfUse", "notice": "Copyright © 1999–2021, The MITRE Corporation. LICENSE Submissions : For all materials you submit to the Common Vulnerabilities and Exposures (CVE™), you hereby grant to The MITRE Corporation (MITRE) and all CVE Numbering Authorities (CNAs) a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute such materials and derivative works. Unless required by applicable law or agreed to in writing, you provide such materials on an \"AS IS\" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied, including, without limitation, any warranties or conditions of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A PARTICULAR PURPOSE. CVE Usage : MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE™). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy. DISCLAIMERS ALL DOCUMENTS AND THE INFORMATION CONTAINED THEREIN PROVIDED BY MITRE ARE PROVIDED ON AN \"AS IS\" BASIS AND THE CONTRIBUTOR, THE ORGANIZATION HE/SHE REPRESENTS OR IS SPONSORED BY (IF ANY), THE MITRE CORPORATION, ITS BOARD OF TRUSTEES, OFFICERS, AGENTS, AND EMPLOYEES, DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION THEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE."}, {"id": "osv", "name": "OSV", "url": "https://osv.dev/", "terms_url": "https://google.github.io/osv.dev/data/", "terms": "Die Lizenzen der Ursprungsdatenbanken unterscheiden sich; siehe Quellenkatalog."}, {"id": "kev", "name": "CISA KEV", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "license": "CC0-1.0", "terms_url": "https://github.com/cisagov/kev-data/blob/develop/LICENSE"}, {"id": "epss", "name": "FIRST EPSS", "url": "https://www.first.org/epss/", "terms_url": "https://www.first.org/epss/faq", "terms": "Frei zugängliche Bewertungen; Quellenangabe erbeten (FIRST EPSS, Bewertungen von Empirical Security)."}, {"id": "github-advisory", "name": "GitHub Advisory Database", "url": "https://github.com/advisories", "license": "CC-BY-4.0", "terms_url": "https://github.com/github/advisory-database/blob/main/LICENSE.md"}, {"id": "exploitdb", "name": "Exploit-DB", "url": "https://www.exploit-db.com/", "license": "GPL-2.0", "terms_url": "https://gitlab.com/exploit-database/exploitdb/-/blob/main/LICENSE.md"}, {"id": "metasploit", "name": "Metasploit", "url": "https://github.com/rapid7/metasploit-framework", "license": "BSD-3-Clause", "terms_url": "https://github.com/rapid7/metasploit-framework/blob/master/LICENSE", "notice": "Copyright (c) 2006-2026, Rapid7, Inc.\nLicense: BSD-3-clause\n Redistribution and use in source and binary forms, with or without modification,\n are permitted provided that the following conditions are met:\n .\n * Redistributions of source code must retain the above copyright notice,\n this list of conditions and the following disclaimer.\n .\n * Redistributions in binary form must reproduce the above copyright notice,\n this list of conditions and the following disclaimer in the documentation\n and/or other materials provided with the distribution.\n .\n * Neither the name of Rapid7, Inc. nor the names of its contributors\n may be used to endorse or promote products derived from this software\n without specific prior written permission.\n .\n THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS \"AS IS\" AND\n ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED\n WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE\n DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR\n ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES\n (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;\n LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON\n ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT\n (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS\n SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE."}, {"id": "nuclei", "name": "Nuclei Templates", "url": "https://github.com/projectdiscovery/nuclei-templates", "license": "MIT", "terms_url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/LICENSE.md", "notice": "MIT License\n\nCopyright (c) 2025 ProjectDiscovery, Inc.\n\nPermission is hereby granted, free of charge, to any person obtaining a copy\nof this software and associated documentation files (the \"Software\"), to deal\nin the Software without restriction, including without limitation the rights\nto use, copy, modify, merge, publish, distribute, sublicense, and/or sell\ncopies of the Software, and to permit persons to whom the Software is\nfurnished to do so, subject to the following conditions:\n\nThe above copyright notice and this permission notice shall be included in all\ncopies or substantial portions of the Software.\n\nTHE SOFTWARE IS PROVIDED \"AS IS\", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR\nIMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,\nFITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE\nAUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER\nLIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,\nOUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE\nSOFTWARE."}, {"id": "linux-kernel", "name": "Linux kernel releases", "url": "https://www.kernel.org/", "license": "CC-BY-SA-4.0", "terms_url": "https://www.kernel.org/legal.html", "notice": "Copyright (C) 1997-2014 by The Linux Kernel Organization, Inc."}]}