Post

We just published 7 CVEs identifying security vulnerabilities in React Router and Remix v2 We recommend updating to the latest appropriate versions: - React Router v7 -- 7.16.0 - React Router v6 -- 6.30.4 - Remix v2 -- 2.17.5 Details, links, and package ranges are listed below

2/6/26, 3:58 pm7 reposts39 likes

Raphaël 👨🏻‍💻

@raphaelbronsveld.com

Mythos?

Nope. Good 'ol real people doing good real people things.

Raphaël 👨🏻‍💻

@raphaelbronsveld.com

3 June

Appreciate your work @ebey.dev !

Brooks Lybrand

@brookslybrand.bsky.social

3 June

I wouldn't be surprised if AI was used to diagnose some of these issues/create repros, however: - the hard work was done by humans: verifying, ideating solutions, fixing solutions, communicating - in my experience you don't need Mythos to apply AI to cybersecurity, it seems to be mostly marketing

Raphaël 👨🏻‍💻

@raphaelbronsveld.com

3 June

Was just curious! Nuxt (apparently) also had some CVE's with (some) Mythos help. Nice work RR team :)

ooh is this Mythos?

Potential CSRF via PUT/PATCH/DELETE document requests github.com/remix-run/re... Framework Mode only Affected versions: - @remix-run/server-runtime >=2.17.3,<2.17.5 - react-router >=7.12.0,<7.15.1

Potential RCE via 2-step attack chained onto existing prototype pollution vulnerability github.com/remix-run/re... Framework Mode only Affected versions: - react-router >= 7.0.0,<= 7.14.1

Same-origin redirect with path starting // causes open redirect via protocol-relative URL reinterpretation github.com/remix-run/re... Framework & Data Mode Affected versions: - react-router >=7.0.0,<7.14.1 - react-router =6.7.0,<6.30.4

github.comSame-origin redirect with path starting // causes open redirect via protocol-relative URL reinterpretationCertain URLs passed to the `redirect` function can trigger an open redirect to an external domain depending on the level of validation done by the application prior to returning the `redirect`. ...

React Router

@reactrouter.com

2 June

DoS via unbounded path expansion in __manifest endpoint github.com/remix-run/re... Framework Mode & Remix v2 Affected versions: - @remix-run/server-runtime >=2.10.0,<2.17.5 - react-router >=7.0.0,<7.15.0

github.comDoS via unbounded path expansion in __manifest endpointThere exists a potential DOS attack vector in React Router Framework Mode applications (as well as Remix v2.10.0 - 2.17.4). Certain requests can be crafted to consume disproportionate resources on...