Vulnerability · Published Jun 2, 2026 · Assigned by GitHub_M
CVE-2026-34077React Router vulnerable to Denial of Service via reflected user input in single-fetch
High 7.5
In plain English
A high-severity resource allocation without limits in react-router from remix-run. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 22% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
React Router is a router for React. In versions 7.7.0 through 7.13.1, when using React Router's unstable React Server Components (RSC) APIs, there is a potential client-side Cross-Site Scripting (XSS) vulnerability in the RSC redirect handling if redirects come from untrusted sources. This does not impact applications that are not using the unstable RSC APIs in React Router. This is patched in version 7.13.2.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| npm | react-router | 7.14.0 | GHSA-rxv8-25v2-qmq8 |
| npm | turbo-stream | 3.0.0 | GHSA-rxv8-25v2-qmq8 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| remix-run | react-router | >= 7.0.0, < 7.14.0 |
| remix-run | turbo-stream | < 3.0.0 |
Weakness: CWE-770 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H