Skip to main content
cve.nowby Sazabi
← npm
npmPackage

react-router

19 known vulnerabilities (10 high, 8 medium, 1 low), with the versions each affects and the releases that fix them.

Latest release
Not known: cve.now hasn't read this package's releases
Newest unaffected release
Not known without release data
Advisories
19 · 10 high, 8 medium, 1 low
Weekly downloads
74.1M
Dependents
349
Registry
npm

Advisories 19

  • CVE-2026-53669Medium 5.1

    React Router: Open redirect via backslash in <Link> and useNavigate (CVE-2025-68470 bypass)

    Affected: from 6.0.0, fixed in 7.18.0.

  • React Router: Unauthenticated Denial of Service via Inefficient Route Matching

    Affected: from 7.0.0, fixed in 7.18.0.

  • CVE-2026-53668Medium 6.9

    React Router: Open redirect can lead to XSS

    Affected: from 7.9.6, fixed in 7.13.0.

  • CVE-2026-53667Medium 6.9

    React Router: Cross-site Scripting is Possible due to Missing RSCErrorHandler Protocol Validation (Incomplete fix for CVE-2026-53667)

    Affected: from 7.11.0, fixed in 7.18.0.

  • CVE-2026-53666Medium 6.1

    React Router: Arbitrary Constructor Injection via deserializeErrors() in React Router SSR Hydration

    Affected: from 6.4.0, fixed in 7.18.0.

  • React Router: `handleDocumentRequest` CSRF check covers `POST` only; PUT/PATCH/DELETE bypass

    Affected: from 7.12.0, fixed in 7.15.1.

  • React Router vulnerable to DoS via unbounded path expansion in __manifest endpoint

    Affected: from 7.0.0, fixed in 7.15.0.

  • React Router's vendored turbo-stream v2 allows arbitrary constructor invocation via TYPE_ERROR deserialization leading to Unauth RCE

    Affected: from 7.0.0, fixed in 7.14.2.

  • CVE-2026-40181Medium 6.6

    React Router's same-origin redirect with path starting // causes open redirect via protocol-relative URL reinterpretation

    Affected: from 7.0.0, fixed in 7.14.1; from 6.7.0, fixed in 6.30.4.

  • React Router vulnerable to Denial of Service via reflected user input in single-fetch

    Affected: from 7.0.0, fixed in 7.14.0.

  • React Router vulnerable to XSS in unstable RSC redirect handling via javascript: redirect targets

    Affected: from 7.7.0, fixed in 7.13.2.

  • CVE-2026-33244Medium 5.4

    React Router has stored XSS via unescaped Location header in prerendered redirect HTML

    Affected: from 7.5.1, fixed in 7.13.2.

  • CVE-2026-22030Medium 6.5

    React Router has CSRF issue in Action/Server Action Request Processing

    Affected: from 7.0.0, fixed in 7.12.0.

  • React Router vulnerable to XSS via Open Redirects

    Affected: from 7.0.0, fixed in 7.12.0.

  • React Router SSR XSS in ScrollRestoration

    Affected: from 7.0.0, fixed in 7.12.0.

Show all 19 advisoriesShow fewer advisories

  • React Router has XSS Vulnerability

    Affected: from 7.0.0, fixed in 7.9.0.

  • CVE-2025-68470Medium 6.5

    React Router has unexpected external redirect via untrusted paths

    Affected: from 6.0.0, fixed in 6.30.2; from 7.0.0, fixed in 7.9.6.

  • React Router allows pre-render data spoofing on React-Router framework mode

    Affected: from 7.0.0-pre.0, fixed in 7.5.2.

  • React Router allows a DoS via cache poisoning by forcing SPA mode

    Affected: from 7.2.0, fixed in 7.5.2.