react-router: @remix-run/server-runtime: React Router / Remix: Denial of Service via unbounded path expansion in __manifest endpoint

🗓️ 20 Jul 2026 11:56:31Reported by RedHatType

Vulnerability in React Router and Remix enables denial of service via unbounded expansion at __manifest endpoint.

Reporter	Title	Published	Views	Family All 44
IBM Security Bulletins	Security Bulletin:Vulnerability in React affects IBM Netezza Appliance	10 Aug 202609:54	–	ibm
IBM Security Bulletins	Security Bulletin: SPSS Collaboration and Deployment Services is affected by multiple vulnerabilities in React Router	6 Jul 202617:10	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple Vulnerabilities in IBM API Connect	7 Jul 202618:33	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Security QRadar Log Management AQL Plugin is vulnerable to using components with known vulnerabilities	13 Jul 202620:16	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple Vulnerabilities in IBM API Connect	14 Jul 202623:33	–	ibm
IBM Security Bulletins	Security Bulletin: MongoDB Enterprised Advanced affected by: Uncontrolled Resource Consumption (CVE-2026-42342)	30 Jul 202615:30	–	ibm
IBM Security Bulletins	Security Bulletin: Security vulnerability in JavaScript affects IBM Robotic Process Automation and IBM Robotic Process Automation for Cloud Pak	20 Jun 202612:50	–	ibm
ATTACKERKB	CVE-2026-42342	2 Jun 202618:23	–	attackerkb
Chainguard	CVE-2026-42342 vulnerabilities	8 Jun 202619:18	–	cgr
Circl	CVE-2026-42342	2 Jun 202621:01	–	circl

Vulners

Node

AND

Source	Link
access	www.access.redhat.com/security/cve/CVE-2026-42342
bugzilla	www.bugzilla.redhat.com/show_bug.cgi
github	www.github.com/remix-run/react-router/security/advisories/GHSA-8x6r-g9mw-2r78
nvd	www.nvd.nist.gov/vuln/detail/CVE-2026-42342
cve	www.cve.org/CVERecord

24 Aug 2026 11:52Current

5.4Medium risk

Vulners AI Score5.4

CVSS 3.17.5

EPSS0.00299

SSVC