Post

We just published 7 CVEs identifying security vulnerabilities in React Router and Remix v2 We recommend updating to the latest appropriate versions: - React Router v7 -- 7.16.0 - React Router v6 -- 6.30.4 - Remix v2 -- 2.17.5 Details, links, and package ranges are listed below

React Router

@reactrouter.com

2 June

Potential CSRF via PUT/PATCH/DELETE document requests github.com/remix-run/re... Framework Mode only Affected versions: - @remix-run/server-runtime >=2.17.3,<2.17.5 - react-router >=7.12.0,<7.15.1

Potential RCE via 2-step attack chained onto existing prototype pollution vulnerability github.com/remix-run/re... Framework Mode only Affected versions: - react-router >= 7.0.0,<= 7.14.1

Same-origin redirect with path starting // causes open redirect via protocol-relative URL reinterpretation github.com/remix-run/re... Framework & Data Mode Affected versions: - react-router >=7.0.0,<7.14.1 - react-router =6.7.0,<6.30.4

github.comSame-origin redirect with path starting // causes open redirect via protocol-relative URL reinterpretationCertain URLs passed to the `redirect` function can trigger an open redirect to an external domain depending on the level of validation done by the application prior to returning the `redirect`. ...

React Router

@reactrouter.com

DoS via unbounded path expansion in __manifest endpoint github.com/remix-run/re... Framework Mode & Remix v2 Affected versions: - @remix-run/server-runtime >=2.10.0,<2.17.5 - react-router >=7.0.0,<7.15.0

github.comDoS via unbounded path expansion in __manifest endpointThere exists a potential DOS attack vector in React Router Framework Mode applications (as well as Remix v2.10.0 - 2.17.4). Certain requests can be crafted to consume disproportionate resources on...

2/6/26, 3:58 pm0 reposts0 likes

React Router

@reactrouter.com

2 June

XSS in unstable RSC redirect handling via javascript: redirect targets github.com/remix-run/re... Unstable RSC APIs only Affected versions: - react-router >=7.7.0,<7.13.2

github.comXSS in unstable RSC redirect handling via javascript: redirect targetsWhen using React Router v7's unstable RSC APIs, there exists a potential client-side XSS issue in the RSC redirect handling if redirects are coming from untrusted sources > [!NOTE] > This only ...

React Router

@reactrouter.com

2 June

Stored XSS via unescaped Location header in prerendered redirect HTML github.com/remix-run/re... Framework Mode with Pre-rendering only Affected versions: - react-router >=7.5.1,<7.13.2

github.comStored XSS via unescaped Location header in prerendered redirect HTMLWhen using React Router v7 [Framework Mode](https://reactrouter.com/start/modes#framework) with [Pre-rendering](https://reactrouter.com/how-to/pre-rendering) enabled, an improper neutralization of ...

React Router

@reactrouter.com

2 June

Denial of Service via reflected user input in single-fetch github.com/remix-run/re... Framework Mode & Remix v2 with Single Fetch enabled Affected versions: - react-router >=7.0.0,<7.14.0 - turbo-stream <=2.4.1

github.comDenial of Service via reflected user input in single-fetchA DoS vulnerability exists in the React Router v7 [Framework Mode](https://reactrouter.com/start/modes#framework), as well as Remix v2.9.0+ with [Single Fetch](https://v2.remix.run/docs/guides/sing...