CVE-2026-53666 React Router: Arbitrary Constructor Injection via deserializeErrors() in React Router SSR Hydration

React Router is a router for React. In versions 6.4.0 through 7.17.0, if application code was written in a way that allows attacker-supplied input to overwrite certain aspects of errors caught by the SSR process, then it was possible for an attacker to trigger unexpected constructor execution on...

NPM: React Router: Arbitrary Constructor Injection via deserializeErrors() in React Router SSR Hydration

NPM: React Router: Arbitrary Constructor Injection via deserializeErrors in React Router SSR Hydration vulnerability discovered by ? in WordPress Npm react-router versions = 6.4.0, 7.18.0...