# react-router (npm) vulnerabilities 19 known vulnerabilities (10 high, 8 medium, 1 low), with the versions each affects and the releases that fix them. ## At a glance - Latest release: 8.5.1 (Oct 27, 2026): no advisory affects it - Newest unaffected release: 8.5.1 (Oct 27, 2026), the latest release - Weekly downloads: 74.1M - Dependents: 349 - Releases: 500+ since 6.30.0 (Feb 27, 2025) - Registry: https://www.npmjs.com/package/react-router - Releases read: Nov 8, 2026 ## Version timeline Affected versions per advisory, in version order: - CVE-2026-53669: 6.30.0-pre-v6.0 to 7.17.0 (7.18.0 is outside it) - CVE-2026-55685: 7.3.0-pre.0 to 7.17.0 (7.18.0 is outside it) - CVE-2026-53668: 7.9.6 to 7.13.0-pre.0 (7.13.0 is outside it) - CVE-2026-53667: 7.11.0 to 7.17.0 (7.18.0 is outside it) - CVE-2026-53666: 6.30.0-pre-v6.0 to 7.17.0 (7.18.0 is outside it) - CVE-2026-53663: 7.12.0 to 7.15.0 (7.15.1 is outside it) - CVE-2026-42342: 7.3.0-pre.0 to 7.14.2 (7.15.0 is outside it) - CVE-2026-42211: 7.3.0-pre.0 to 7.14.1 (7.14.2 is outside it) - CVE-2026-40181: 6.30.0-pre-v6.0 to 6.30.3 (6.30.4 is outside it); 7.3.0-pre.0 to 7.14.0 (7.14.1 is outside it) - CVE-2026-34077: 7.3.0-pre.0 to 7.14.0-pre.0 (7.14.0 is outside it) - CVE-2026-33245: 7.7.0 to 7.13.2-pre.0 (7.13.2 is outside it) - CVE-2026-33244: 7.5.1 to 7.13.2-pre.0 (7.13.2 is outside it) - CVE-2026-22030: 7.3.0-pre.0 to 7.12.0-pre.0 (7.12.0 is outside it) - CVE-2026-22029: 7.3.0-pre.0 to 7.12.0-pre.0 (7.12.0 is outside it) - CVE-2026-21884: 7.3.0-pre.0 to 7.12.0-pre.0 (7.12.0 is outside it) - CVE-2025-59057: 7.3.0-pre.0 to 7.9.0-pre.1 (7.9.0 is outside it) - CVE-2025-68470: 6.30.0-pre-v6.0 to 6.30.2-pre-v6.0 (6.30.2 is outside it); 7.3.0-pre.0 to 7.9.6-pre.1 (7.9.6 is outside it) - CVE-2025-43865: 7.3.0-pre.0 to 7.5.1 (7.5.2 is outside it) - CVE-2025-43864: 7.3.0-pre.0 to 7.5.1 (7.5.2 is outside it) Older releases aren't stored, so the earliest spans may start sooner. ## Advisories (19) ### [CVE-2026-53669](https://cve.now/CVE-2026-53669): React Router: Open redirect via backslash in \ and useNavigate (CVE-2025-68470 bypass) - Severity: Medium 5.1 - Published: Jul 27, 2026 - Affected: from 6.0.0, fixed in 7.18.0. - Fixed in 7.18.0 (released Jun 16, 2026, 41 days before disclosure). - The latest release, 8.5.1, is not affected. - 45% of react-router downloads last week were affected versions (36.4M). ### [CVE-2026-55685](https://cve.now/CVE-2026-55685): React Router: Unauthenticated Denial of Service via Inefficient Route Matching - Severity: High 8.7 - Published: Jul 27, 2026 - Affected: from 7.0.0, fixed in 7.18.0. - Fixed in 7.18.0 (released Jun 16, 2026, 41 days before disclosure). - The latest release, 8.5.1, is not affected. - 12% of react-router downloads last week were affected versions (10.1M). ### [CVE-2026-53668](https://cve.now/CVE-2026-53668): React Router: Open redirect can lead to XSS - Severity: Medium 6.9 - Published: Jul 27, 2026 - Affected: from 7.9.6, fixed in 7.13.0. - Fixed in 7.13.0 (released Jan 23, 2026, 185 days before disclosure). - The latest release, 8.5.1, is not affected. - 1.4% of react-router downloads last week were affected versions (1.1M). ### [CVE-2026-53667](https://cve.now/CVE-2026-53667): React Router: Cross-site Scripting is Possible due to Missing RSCErrorHandler Protocol Validation (Incomplete fix for CVE-2026-53667) - Severity: Medium 6.9 - Published: Jul 27, 2026 - Affected: from 7.11.0, fixed in 7.18.0. - Fixed in 7.18.0 (released Jun 16, 2026, 41 days before disclosure). - The latest release, 8.5.1, is not affected. - 7.9% of react-router downloads last week were affected versions (6.4M). ### [CVE-2026-53666](https://cve.now/CVE-2026-53666): React Router: Arbitrary Constructor Injection via deserializeErrors() in React Router SSR Hydration - Severity: Medium 6.1 - Published: Jul 27, 2026 - Affected: from 6.4.0, fixed in 7.18.0. - Fixed in 7.18.0 (released Jun 16, 2026, 41 days before disclosure). - The latest release, 8.5.1, is not affected. - 44% of react-router downloads last week were affected versions (35.8M). ### [CVE-2026-53663](https://cve.now/CVE-2026-53663): React Router: \`handleDocumentRequest\` CSRF check covers \`POST\` only; PUT/PATCH/DELETE bypass - Severity: Low 3.1 - Published: Jun 22, 2026 - Affected: from 7.12.0, fixed in 7.15.1. - Fixed in 7.15.1 (released May 14, 2026, 39 days before disclosure). - The latest release, 8.5.1, is not affected. - 5.7% of react-router downloads last week were affected versions (4.6M). ### [CVE-2026-42342](https://cve.now/CVE-2026-42342): React Router vulnerable to DoS via unbounded path expansion in \_\_manifest endpoint - Severity: High 7.5 - Published: Jun 2, 2026 - Affected: from 7.0.0, fixed in 7.15.0. - Fixed in 7.15.0 (released May 5, 2026, 28 days before disclosure). - The latest release, 8.5.1, is not affected. - 9.9% of react-router downloads last week were affected versions (8.1M). ### [CVE-2026-42211](https://cve.now/CVE-2026-42211): React Router's vendored turbo-stream v2 allows arbitrary constructor invocation via TYPE\_ERROR deserialization leading to Unauth RCE - Severity: High 8.1 - Published: Jun 2, 2026 - Affected: from 7.0.0, fixed in 7.14.2. - Fixed in 7.14.2 (released Apr 21, 2026, 42 days before disclosure). - The latest release, 8.5.1, is not affected. - 9.2% of react-router downloads last week were affected versions (7.5M). ### [CVE-2026-40181](https://cve.now/CVE-2026-40181): React Router's same-origin redirect with path starting // causes open redirect via protocol-relative URL reinterpretation - Severity: Medium 6.6 - Published: Jun 2, 2026 - Affected: from 7.0.0, fixed in 7.14.1; from 6.7.0, fixed in 6.30.4. - Fixed in 6.30.4 (released May 29, 2026, 4 days before disclosure) and 7.14.1 (released Apr 13, 2026, 50 days before disclosure). - The latest release, 8.5.1, is not affected. - 25% of react-router downloads last week were affected versions (20.5M). ### [CVE-2026-34077](https://cve.now/CVE-2026-34077): React Router vulnerable to Denial of Service via reflected user input in single-fetch - Severity: High 7.5 - Published: Jun 2, 2026 - Affected: from 7.0.0, fixed in 7.14.0. - Fixed in 7.14.0 (released Apr 2, 2026, 61 days before disclosure). - The latest release, 8.5.1, is not affected. - 8.4% of react-router downloads last week were affected versions (6.8M). ### [CVE-2026-33245](https://cve.now/CVE-2026-33245): React Router vulnerable to XSS in unstable RSC redirect handling via javascript: redirect targets - Severity: High 8.0 - Published: Jun 2, 2026 - Affected: from 7.7.0, fixed in 7.13.2. - Fixed in 7.13.2 (released Mar 23, 2026, 71 days before disclosure). - The latest release, 8.5.1, is not affected. - 6.5% of react-router downloads last week were affected versions (5.3M). ### [CVE-2026-33244](https://cve.now/CVE-2026-33244): React Router has stored XSS via unescaped Location header in prerendered redirect HTML - Severity: Medium 5.4 - Published: Jun 2, 2026 - Affected: from 7.5.1, fixed in 7.13.2. - Fixed in 7.13.2 (released Mar 23, 2026, 71 days before disclosure). - The latest release, 8.5.1, is not affected. - 7.3% of react-router downloads last week were affected versions (6M). ### [CVE-2026-22030](https://cve.now/CVE-2026-22030): React Router has CSRF issue in Action/Server Action Request Processing - Severity: Medium 6.5 - Published: Jan 10, 2026 - Affected: from 7.0.0, fixed in 7.12.0. - Fixed in 7.12.0 (released Jan 7, 2026, 3 days before disclosure). - The latest release, 8.5.1, is not affected. - 4.8% of react-router downloads last week were affected versions (3.9M). ### [CVE-2026-22029](https://cve.now/CVE-2026-22029): React Router vulnerable to XSS via Open Redirects - Severity: High 8.0 - Published: Jan 10, 2026 - Affected: from 7.0.0, fixed in 7.12.0. - Fixed in 7.12.0 (released Jan 7, 2026, 3 days before disclosure). - The latest release, 8.5.1, is not affected. - 4.8% of react-router downloads last week were affected versions (3.9M). ### [CVE-2026-21884](https://cve.now/CVE-2026-21884): React Router SSR XSS in ScrollRestoration - Severity: High 8.2 - Published: Jan 10, 2026 - Affected: from 7.0.0, fixed in 7.12.0. - Fixed in 7.12.0 (released Jan 7, 2026, 3 days before disclosure). - The latest release, 8.5.1, is not affected. - 4.8% of react-router downloads last week were affected versions (3.9M). ### [CVE-2025-59057](https://cve.now/CVE-2025-59057): React Router has XSS Vulnerability - Severity: High 7.6 - Published: Jan 10, 2026 - Affected: from 7.0.0, fixed in 7.9.0. - Fixed in 7.9.0 (released Sep 12, 2025, 120 days before disclosure). - The latest release, 8.5.1, is not affected. - 2.2% of react-router downloads last week were affected versions (1.8M). ### [CVE-2025-68470](https://cve.now/CVE-2025-68470): React Router has unexpected external redirect via untrusted paths - Severity: Medium 6.5 - Published: Jan 10, 2026 - Affected: from 6.0.0, fixed in 6.30.2; from 7.0.0, fixed in 7.9.6. - Fixed in 6.30.2 (released Nov 13, 2025, 58 days before disclosure) and 7.9.6 (released Nov 13, 2025, 58 days before disclosure). - The latest release, 8.5.1, is not affected. - 16% of react-router downloads last week were affected versions (12.7M). ### [CVE-2025-43865](https://cve.now/CVE-2025-43865): React Router allows pre-render data spoofing on React-Router framework mode - Severity: High 8.2 - Published: Apr 25, 2025 - Affected: from 7.0.0-pre.0, fixed in 7.5.2. - Fixed in 7.5.2 (released Apr 24, 2025, 1 day before disclosure). - The latest release, 8.5.1, is not affected. - 0.6% of react-router downloads last week were affected versions (477.5K). ### [CVE-2025-43864](https://cve.now/CVE-2025-43864): React Router allows a DoS via cache poisoning by forcing SPA mode - Severity: High 7.5 - Published: Apr 25, 2025 - Affected: from 7.2.0, fixed in 7.5.2. - Fixed in 7.5.2 (released Apr 24, 2025, 1 day before disclosure). - The latest release, 8.5.1, is not affected. - 0.3% of react-router downloads last week were affected versions (219.9K). --- Source: cve.now Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards. Page: https://cve.now/packages/npm/react-router Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.