Log in Start free

Vulnerability · Published Jan 10, 2026 · Assigned by GitHub_M

CVE-2026-21884React Router SSR XSS in ScrollRestoration

High 8.2

In plain English

A high-severity cross-site scripting in react-router from remix-run. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 45% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)8.2High
Exploit odds (30 days)0.5%top 54.9% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

React Router is a router for React. In @remix-run/react version prior to 2.17.3. and react-router 7.0.0 through 7.11.0, a XSS vulnerability exists in in React Router's <ScrollRestoration> API in Framework Mode when using the getKey/storageKey props during Server-Side Rendering which could allow arbitrary JavaScript execution during SSR if untrusted content is used to generate the keys. There is no impact if server-side rendering in Framework Mode is disabled, or if Declarative Mode (<BrowserRouter>) or Data Mode (createBrowserRouter/<RouterProvider>) is being used. This issue has been patched in @remix-run/react version 2.17.3 and react-router version 7.12.0.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
npm@remix-run/react2.17.3GHSA-8v8x-cx79-35w7
npmreact-router7.12.0GHSA-8v8x-cx79-35w7

Affected products (as reported)

VendorProductVersions
remix-run react-router @remix-run/react < 2.17.3react-router >= 7.0.0, < 7.12.0

Weakness: CWE-79 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N

References