CVE-2026-33244
MediumCVSS 5.4Exploitation Probability (EPSS)
Low risk4th percentile - higher than 4% of all known CVEs
Summary
React Router versions 7.5.1 through 7.13.1 in Framework Mode with pre-rendering enabled improperly neutralize the HTTP Location header, allowing XSS in static HTML files if the redirect source is untrusted. Not affected in Declarative or Data Mode. Patched in version 7.13.2.
Risk Assessment
An attacker can inject malicious scripts into static HTML files, potentially leading to data theft or session hijacking.
Recommendation
Update React Router to version 7.13.2 or later.
Other vulnerabilities in React Router
See all- CVE-2025-61686Critical
In React Router and Remix Run libraries, a vulnerability allows reading/writing session files outside the specified directory when using createFileSessionStorage() with an unsigned cookie. An attacker can cause the session to access locations outside the intended session file directory, depending on web server process permissions.
- CVE-2026-55685High
Vulnerability in React Router versions 7.0.0 through 7.17.0. Unauthenticated requests to the manifest endpoint can overload the server and slow down responses. This does not affect applications using Declarative Mode (<BrowserRouter>) or Data Mode (createBrowserRouter/<RouterProvider>).
- CVE-2026-53669Medium
React Router versions 6.0.0 through 7.17.0 are vulnerable to Open Redirect through use of backslashes in <Link> and useNavigate. This issue has been fixed in version 7.18.0.
- CVE-2026-53668Medium
React Router versions 6.30.2 through 6.30.4 and 7.9.6 through 7.12.0 are vulnerable to XSS in applications that allow open redirects. An attacker could craft a malicious link that redirects users to an unexpected external site or exploits an XSS vector. This issue has been fixed in version 7.13.0.
- CVE-2026-53667Medium
React Router versions 7.11.0 through 7.17.0 are missing protocol validation in RSCErrorHandler, allowing redirects from untrusted sources. This only affects applications using unstable RSC APIs. Fixed in version 7.18.0.
- CVE-2026-53666Medium
React Router versions 6.4.0 through 7.17.0 allow unexpected constructor execution on the client if application code allows attacker-supplied input to overwrite certain aspects of SSR errors. This can trigger an outbound network request. Only affects Framework Mode and Data Mode applications performing manual SSR/hydration. Fixed in version 7.18.0.
- CVE-2026-53663Low
React Router versions from 7.12.0 to 7.15.1 had insufficient CSRF checks in Framework Mode that operated on POST requests but were bypassed on PUT/PATCH/DELETE requests. This vulnerability is fixed in version 7.15.1.
- CVE-2026-42342High
React Router versions 7.0.0 through 7.14.x and @remix-run/server-runtime versions 2.10.0 through 2.17.4 contain a DoS vulnerability via unbounded path expansion in the __manifest endpoint. Attackers can send crafted requests that consume excessive server resources.
- CVE-2026-42211High
React Router versions 7.0.0 through 7.14.1 in Framework Mode can allow remote code execution (RCE) via external requests if the application has an existing prototype pollution vulnerability. Two-step attack. Does not affect Declarative or Data Mode.
- CVE-2026-40181Medium
React Router versions 7.0.0 through 7.14.0 and 6.7.0 through 6.30.3 contain an open redirect vulnerability where certain URLs passed to the redirect function can be reinterpreted as protocol-relative URLs, redirecting to an external domain.
Original NVD description (English source)
React Router is a router for React. In versions 7.5.1 through 7.13.1, when using Framework Mode with pre-rendering enabled, improper neutralization of the HTTP `Location` header value can permit Cross-Site Scripting (XSS) in the statically generated HTML files if the redirect location comes from an untrusted source. This does not impact applications using Declarative Mode (`<BrowserRouter>`) or Data Mode (`createBrowserRouter/<RouterProvider>`). This is patched in version 7.13.2.