CLSA-2026-1789597929 TuxCare security update for @remix-run/router (1 CVE)

TuxCare rebuilt @remix-run/router to address 1 CVE. Fixed in 1.23.0-tuxcare.3...

PT-2026-99441

TuxCare rebuilt @remix-run/router to address 1 CVE. Fixed in 1.23.0-tuxcare.3...

PT-2026-75007

TuxCare rebuilt @remix-run/router to address 3 CVEs. Fixed in 1.15.3-tuxcare.1...

@1023-ventures/merope2 (>=0.2.1, <=0.2.9), @1023-ventures/vega-core (>=0.5.0, <=0.6.2) +1352 more potentially affected by CVE-2026-40181 via @remix-run/router (>=1.3.0, <=1.23.2)

@remix-run/router NPM version =1.3.0, =0.2.1, =0.5.0, =0.0.1, =0.0.1, =3.0.0, =0.0.0-beta-20260120211922, =1.0.0, =1.0.0, =1.0.0, =2.7.0, =0.0.1, =0.1.0, =0.0.0, =2.13.1, =2.13.94 and more Source cves: CVE-2026-40181 Source advisory: GHSA-2J2X-HQR9-3H42...

@1023-ventures/merope2 (>=0.2.1, <=0.2.9), @1023-ventures/vega-core (>=0.5.0, <=0.6.2) +1352 more potentially affected by CVE-2026-40181 via @remix-run/router (>=1.3.0, <=1.23.2)

@remix-run/router NPM version =1.3.0, =0.2.1, =0.5.0, =0.0.1, =0.0.1, =3.0.0, =0.0.0-beta-20260120211922, =1.0.0, =1.0.0, =1.0.0, =2.7.0, =0.0.1, =0.1.0, =0.0.0, =2.13.1, =2.13.94 and more Source cves: CVE-2026-40181 Source advisory: OSV:GHSA-2J2X-HQR9-3H42...

@1023-ventures/merope2 (>=0.2.1, <=0.2.9), @1023-ventures/vega-core (>=0.5.0, <=0.6.2) +1352 more potentially affected by CVE-2026-40181 via @remix-run/router (>=1.3.0, <=1.23.2)

@remix-run/router NPM version =1.3.0, =0.2.1, =0.5.0, =0.0.1, =0.0.1, =3.0.0, =0.0.0-beta-20260120211922, =1.0.0, =1.0.0, =1.0.0, =2.7.0, =0.0.1, =0.1.0, =0.0.0, =2.13.1, =2.13.94 and more Source cves: CVE-2026-40181 Source advisory: MEND:CVE-2026-40181...

@1023-ventures/merope2 (>=0.2.1, <=0.2.9), @1023-ventures/vega-core (>=0.5.0, <=0.6.2) +1414 more potentially affected by CVE-2026-22029 via @remix-run/router (>=0.0.0-experimental-a077dc2d, <=1.23.2-pre-v6.0)

@remix-run/router NPM version =0.0.0-experimental-a077dc2d, =0.2.1, =0.5.0, =0.0.1, =0.0.1, =3.0.0, =0.0.0-beta-20260120211922, =1.0.0, =1.0.0, =1.0.0, =2.7.0, =0.0.1, =0.1.0, =0.0.0, =6.24.1, =8.19.1 and more Source cves: CVE-2026-22029 Source advisory: MEND:CVE-2026-22029...

CVE-2026-22029: Improper Neutralization of Input During Web Page Generation

React Router is a router for React. In @remix-run/router version prior to 1.23.2 and react-router 7.0.0 through 7.11.0, React Router and Remix v1/v2 SPA open navigation redirects originating from loaders or actions in Framework Mode, Data Mode, or the unstable RSC modes can result in unsafe URLs...