CVE-2026-22029
HighCVSS 8.0Exploitation Probability (EPSS)
Elevated risk53th percentile - higher than 53% of all known CVEs
Summary
In @remix-run/router before 1.23.2 and react-router 7.0.0-7.11.0, SPA open navigation redirects from loaders/actions in Framework, Data, or RSC modes can result in unsafe URLs causing unintended JavaScript execution on the client. This is only an issue when creating redirect paths from untrusted content or via an open redirect.
Risk Assessment
The organization is exposed to XSS attacks via open redirects, potentially leading to session data theft, account takeover, or malicious code execution in victims' browsers.
Recommendation
Immediately update @remix-run/router to version 1.23.2 or later and react-router to version 7.12.0 or later. No impact if using Declarative Mode (<BrowserRouter>).
Other vulnerabilities in React Router
See all- CVE-2025-61686Critical
In React Router and Remix Run libraries, a vulnerability allows reading/writing session files outside the specified directory when using createFileSessionStorage() with an unsigned cookie. An attacker can cause the session to access locations outside the intended session file directory, depending on web server process permissions.
- CVE-2026-55685High
Vulnerability in React Router versions 7.0.0 through 7.17.0. Unauthenticated requests to the manifest endpoint can overload the server and slow down responses. This does not affect applications using Declarative Mode (<BrowserRouter>) or Data Mode (createBrowserRouter/<RouterProvider>).
- CVE-2026-53669Medium
React Router versions 6.0.0 through 7.17.0 are vulnerable to Open Redirect through use of backslashes in <Link> and useNavigate. This issue has been fixed in version 7.18.0.
- CVE-2026-53668Medium
React Router versions 6.30.2 through 6.30.4 and 7.9.6 through 7.12.0 are vulnerable to XSS in applications that allow open redirects. An attacker could craft a malicious link that redirects users to an unexpected external site or exploits an XSS vector. This issue has been fixed in version 7.13.0.
- CVE-2026-53667Medium
React Router versions 7.11.0 through 7.17.0 are missing protocol validation in RSCErrorHandler, allowing redirects from untrusted sources. This only affects applications using unstable RSC APIs. Fixed in version 7.18.0.
- CVE-2026-53666Medium
React Router versions 6.4.0 through 7.17.0 allow unexpected constructor execution on the client if application code allows attacker-supplied input to overwrite certain aspects of SSR errors. This can trigger an outbound network request. Only affects Framework Mode and Data Mode applications performing manual SSR/hydration. Fixed in version 7.18.0.
- CVE-2026-53663Low
React Router versions from 7.12.0 to 7.15.1 had insufficient CSRF checks in Framework Mode that operated on POST requests but were bypassed on PUT/PATCH/DELETE requests. This vulnerability is fixed in version 7.15.1.
- CVE-2026-42342High
React Router versions 7.0.0 through 7.14.x and @remix-run/server-runtime versions 2.10.0 through 2.17.4 contain a DoS vulnerability via unbounded path expansion in the __manifest endpoint. Attackers can send crafted requests that consume excessive server resources.
- CVE-2026-42211High
React Router versions 7.0.0 through 7.14.1 in Framework Mode can allow remote code execution (RCE) via external requests if the application has an existing prototype pollution vulnerability. Two-step attack. Does not affect Declarative or Data Mode.
- CVE-2026-40181Medium
React Router versions 7.0.0 through 7.14.0 and 6.7.0 through 6.30.3 contain an open redirect vulnerability where certain URLs passed to the redirect function can be reinterpreted as protocol-relative URLs, redirecting to an external domain.
Original NVD description (English source)
React Router is a router for React. In @remix-run/router version prior to 1.23.2 and react-router 7.0.0 through 7.11.0, React Router (and Remix v1/v2) SPA open navigation redirects originating from loaders or actions in Framework Mode, Data Mode, or the unstable RSC modes can result in unsafe URLs causing unintended javascript execution on the client. This is only an issue if you are creating redirect paths from untrusted content or via an open redirect. There is no impact if Declarative Mode (<BrowserRouter>) is being used. This issue has been patched in @remix-run/router version 1.23.2 and react-router version 7.12.0.