Log in Start free

@remix-run

Products

ProductCVEsExploitedLatest
react-router21–Jul 27, 2026
@remix-run/router2–Jun 2, 2026
@remix-run/server-runtime1–Jun 2, 2026
server-runtime1–Jun 22, 2026
turbo-stream1–Jun 2, 2026

Exploited and recent CVEs

  • CVE-2026-53669 Medium 5.1 React Router: Open redirect via backslash in <Link> and useNavigate (CVE-2025-68470 bypass) 0.3%
  • CVE-2026-55685 High 8.7 React Router: Unauthenticated Denial of Service via Inefficient Route Matching 0.7%
  • CVE-2026-53668 Medium 6.9 React Router: Open redirect can lead to XSS 0.3%
  • CVE-2026-53667 Medium 6.9 React Router: Cross-site Scripting is Possible due to Missing RSCErrorHandler Protocol Validation (Incomplete fix for CVE-2026-53667) 0.4%
  • CVE-2026-53666 Medium 6.1 React Router: Arbitrary Constructor Injection via deserializeErrors() in React Router SSR Hydration 0.4%
  • CVE-2026-53663 Low 3.1 React Router: `handleDocumentRequest` CSRF check covers `POST` only; PUT/PATCH/DELETE bypass 0.1%
  • CVE-2026-53663 Low 3.1 React Router: `handleDocumentRequest` CSRF check covers `POST` only; PUT/PATCH/DELETE bypass 0.1%
  • CVE-2026-42342 High 7.5 React Router vulnerable to DoS via unbounded path expansion in __manifest endpoint 0.3%
  • CVE-2026-42342 High 7.5 React Router vulnerable to DoS via unbounded path expansion in __manifest endpoint 0.3%
  • CVE-2026-42211 High 8.1 React Router's vendored turbo-stream v2 allows arbitrary constructor invocation via TYPE_ERROR deserialization leading to Unauth RCE 0.4%
  • CVE-2026-40181 Medium 6.6 React Router's same-origin redirect with path starting // causes open redirect via protocol-relative URL reinterpretation 0.2%
  • CVE-2026-40181 Medium 6.6 React Router's same-origin redirect with path starting // causes open redirect via protocol-relative URL reinterpretation 0.2%
  • CVE-2026-34077 High 7.5 React Router vulnerable to Denial of Service via reflected user input in single-fetch 0.3%
  • CVE-2026-34077 High 7.5 React Router vulnerable to Denial of Service via reflected user input in single-fetch 0.3%
  • CVE-2026-33245 High 8.0 React Router vulnerable to XSS in unstable RSC redirect handling via javascript: redirect targets 0.2%
  • CVE-2026-33244 Medium 5.4 React Router has stored XSS via unescaped Location header in prerendered redirect HTML 0.1%
  • CVE-2026-22030 Medium 6.5 React Router has CSRF issue in Action/Server Action Request Processing 0.2%
  • CVE-2026-22029 High 8.0 React Router vulnerable to XSS via Open Redirects 0.9%
  • CVE-2026-22029 High 8.0 React Router vulnerable to XSS via Open Redirects 0.9%
  • CVE-2026-21884 High 8.2 React Router SSR XSS in ScrollRestoration 0.5%
  • CVE-2025-61686 Critical 9.1 React Router has Path Traversal in File Session Storage 17.3%
  • CVE-2025-59057 High 7.6 React Router has XSS Vulnerability 0.5%
  • CVE-2025-68470 Medium 6.5 React Router has unexpected external redirect via untrusted paths 0.5%
  • CVE-2025-43865 High 8.2 React Router allows pre-render data spoofing on React-Router framework mode 0.8%
  • CVE-2025-43864 High 7.5 React Router allows a DoS via cache poisoning by forcing SPA mode 20.5%
  • CVE-2025-31137 High 7.5 Remix and React Router allow URL manipulation via Host / X-Forwarded-Host headers 1.2%