CVE-2026-21884 React Router SSR XSS in ScrollRestoration

🗓️ 10 Jan 2026 02:41:44Reported by GitHub_MType

CVE-2026-21884: SSR XSS in ScrollRestoration via getKey/storageKey in Framework Mode; patched.

Reporter	Title	Published	Views	Family All 36
IBM Security Bulletins	Security Bulletin: Investigation Assistant App for IBM QRadar SIEM is vulnerable to using components with known vulnerabilities	6 Apr 202617:16	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerabilities exists in IBM Netezza Software	25 Jun 202602:33	–	ibm
IBM Security Bulletins	Security Bulletin: MongoDB Enterprised Advanced affected by: react-router-7.11.0.tgz (CVE-2026-21884, CVE-2026-22029, CVE-2026-22030)	11 May 202618:23	–	ibm
IBM Security Bulletins	Security Bulletin: Carbon Charts React Router Security Vulnerabilities	27 Apr 202607:14	–	ibm
IBM Security Bulletins	Security Bulletin: The following vulnerabilities that can affect IBM Storage Scale Management GUI and/or BDA are now included.	2 Mar 202623:03	–	ibm
IBM Security Bulletins	Security Bulletin: XSS Vulnerability in React Router meta()/Meta APIs During SSR, affects watsonx.data	10 Apr 202605:59	–	ibm
Circl	CVE-2026-21884	10 Jan 202603:23	–	circl
CNNVD	react-router 跨站脚本漏洞	10 Jan 202600:00	–	cnnvd
CVE	CVE-2026-21884	10 Jan 202602:41	–	cve
Atlassian	DOM-based XSS react-router-dom Dependency in Crowd Data Center	3 Mar 202618:29	–	atlassian

[
  {
    "vendor": "remix-run",
    "product": "react-router",
    "versions": [
      {
        "version": "@remix-run/react < 2.17.3",
        "status": "affected"
      },
      {
        "version": "react-router  >= 7.0.0, < 7.12.0",
        "status": "affected"
      }
    ]
  }
]

Source	Link
github	www.github.com/remix-run/react-router/security/advisories/GHSA-8v8x-cx79-35w7

10 Jan 2026 02:41Current

CVSS 3.18.2

EPSS0.00366

CWE-79