CVE-2026-53668
MediumCVSS 6.9Exploitation Probability (EPSS)
Low risk26th percentile - higher than 26% of all known CVEs
Summary
React Router versions 6.30.2 through 6.30.4 and 7.9.6 through 7.12.0 are vulnerable to XSS in applications that allow open redirects. An attacker could craft a malicious link that redirects users to an unexpected external site or exploits an XSS vector. This issue has been fixed in version 7.13.0.
Risk Assessment
The risk is that an attacker can execute malicious scripts in the victim's browser, potentially leading to session or data theft.
Recommendation
Update React Router to version 7.13.0 or later.
Other vulnerabilities in React Router
See all- CVE-2025-61686Critical
In React Router and Remix Run libraries, a vulnerability allows reading/writing session files outside the specified directory when using createFileSessionStorage() with an unsigned cookie. An attacker can cause the session to access locations outside the intended session file directory, depending on web server process permissions.
- CVE-2026-55685High
Vulnerability in React Router versions 7.0.0 through 7.17.0. Unauthenticated requests to the manifest endpoint can overload the server and slow down responses. This does not affect applications using Declarative Mode (<BrowserRouter>) or Data Mode (createBrowserRouter/<RouterProvider>).
- CVE-2026-53669Medium
React Router versions 6.0.0 through 7.17.0 are vulnerable to Open Redirect through use of backslashes in <Link> and useNavigate. This issue has been fixed in version 7.18.0.
- CVE-2026-53667Medium
React Router versions 7.11.0 through 7.17.0 are missing protocol validation in RSCErrorHandler, allowing redirects from untrusted sources. This only affects applications using unstable RSC APIs. Fixed in version 7.18.0.
- CVE-2026-53666Medium
React Router versions 6.4.0 through 7.17.0 allow unexpected constructor execution on the client if application code allows attacker-supplied input to overwrite certain aspects of SSR errors. This can trigger an outbound network request. Only affects Framework Mode and Data Mode applications performing manual SSR/hydration. Fixed in version 7.18.0.
- CVE-2026-53663Low
React Router versions from 7.12.0 to 7.15.1 had insufficient CSRF checks in Framework Mode that operated on POST requests but were bypassed on PUT/PATCH/DELETE requests. This vulnerability is fixed in version 7.15.1.
- CVE-2026-42342High
React Router versions 7.0.0 through 7.14.x and @remix-run/server-runtime versions 2.10.0 through 2.17.4 contain a DoS vulnerability via unbounded path expansion in the __manifest endpoint. Attackers can send crafted requests that consume excessive server resources.
- CVE-2026-42211High
React Router versions 7.0.0 through 7.14.1 in Framework Mode can allow remote code execution (RCE) via external requests if the application has an existing prototype pollution vulnerability. Two-step attack. Does not affect Declarative or Data Mode.
- CVE-2026-40181Medium
React Router versions 7.0.0 through 7.14.0 and 6.7.0 through 6.30.3 contain an open redirect vulnerability where certain URLs passed to the redirect function can be reinterpreted as protocol-relative URLs, redirecting to an external domain.
- CVE-2026-34077High
Client-side Cross-Site Scripting (XSS) vulnerability in React Router versions 7.7.0 through 7.13.1, occurring during RSC redirect handling from untrusted sources. Only affects applications using unstable RSC APIs.
Original NVD description (English source)
React Router is a router for React. In versions 6.30.2 through 6.30.4 and 7.9.6 through 7.12.0, applications that allow open redirects are vulnerable to XSS. An attacker could craft a malicious link that redirects users to an unexpected external site or that exploits an XSS vector.This issue has been fixed in version 7.13.0.