31g-form-parser (=1.0.107), @0xmike/web-kit (>=0.0.6 <=0.1.1) +450 more potentially affected by CVE-2026-34077 via turbo-stream (>=1.2.1 <=2.4.1)

turbo-stream NPM version =1.2.1, =0.0.6, =4.0.0, =4.15.0, =0.0.3, =1.4.0, =0.0.1, =1.2.0, =1.2.0, =0.1.0, =1.0.10, =0.0.2, =1.0.0, =0.0.2, =0.0.13 and more Source cves: CVE-2026-34077 Source advisory: OSV:GHSA-RXV8-25V2-QMQ8...

@accounter/client (>=0.0.3 <=0.0.11-alpha-20260404002702-9340365def1af08a5cdbbf734a87d1d4839bdaff), @asamanvay/auth-service (>=0.0.2 <=0.0.4) +122 more potentially affected by CVE-2026-34077 via react-router (>=7.0.0 <=7.14.0-pre.0)

react-router NPM version =7.0.0, =0.0.3, =0.0.2, =3.5.2, =1.1.0, =1.0.1-MON-198808-web-js-deps-batch-1.0, =0.0.1, =3.4.9, =0.1.9, =1.27.1, =1.27.1, =0.3.1, =7.13.1-depup.0, =7.13.2-depup.0 and more Source cves: CVE-2026-34077 Source advisory: OSV:GHSA-RXV8-25V2-QMQ8...

CVE-2026-34077

creationtimestamp| type| source ---|---|--- 2026-06-02 23:00:45+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mndp5yc5eh2p 2026-06-04 15:40:51+00:00| seen| https://gist.github.com/alon710/3d94838c8c562b52d8cc99e4e0d339c7 2026-06-28 17:15:14+00:00| seen|...

@0xmike/web-kit (>=0.0.6 <=0.1.1), @abundiko/expo-template (=1.0.0) +316 more potentially affected by CVE-2026-34077 via turbo-stream (=2.4.1)

turbo-stream NPM version =2.4.1 is affected by a known vulnerability. The following packages have a transitive dependency on turbo-stream and may be impacted: - @0xmike/web-kit =0.0.6, =4.0.0, =4.15.0, =1.4.0, =0.0.1, =1.2.0, =1.2.0, =0.1.0, =1.0.10, =1.0.0, =0.0.2, =0.0.1, =1.0.6, =2.1.0 -...

@accounter/client (>=0.0.3 <=0.0.11-alpha-20260404002702-9340365def1af08a5cdbbf734a87d1d4839bdaff), @asamanvay/auth-service (>=0.0.2 <=0.0.4) +122 more potentially affected by CVE-2026-34077 via react-router (>=7.0.0 <=7.14.0-pre.0)

react-router NPM version =7.0.0, =0.0.3, =0.0.2, =3.5.2, =1.1.0, =1.0.1-MON-198808-web-js-deps-batch-1.0, =0.0.1, =3.4.9, =0.1.9, =1.27.1, =1.27.1, =0.3.1, =7.13.1-depup.0, =7.13.2-depup.0 and more Source cves: CVE-2026-34077 Source advisory: SNYK:JS-REACTROUTER-17138883...

CVE-2026-34077 React Router vulnerable to Denial of Service via reflected user input in single-fetch

React Router is a router for React. In versions 7.7.0 through 7.13.1, when using React Router's unstable React Server Components RSC APIs, there is a potential client-side Cross-Site Scripting XSS vulnerability in the RSC redirect handling if redirects come from untrusted sources. This does not...