SUSE CVE-2026-33245

React Router is a router for React. In versions 7.7.0 through 7.13.1, when using React Router's unstable React Server Components RSC APIs, there is a potential client-side Cross-Site Scripting XSS vulnerability in the RSC redirect handling if redirects come from untrusted sources. This does not...

SUSE CVE-2026-34077

React Router is a router for React. In versions 7.7.0 through 7.13.1, when using React Router's unstable React Server Components RSC APIs, there is a potential client-side Cross-Site Scripting XSS vulnerability in the RSC redirect handling if redirects come from untrusted sources. This does not...

SUSE CVE-2026-40181

React Router is a router for React. In versions 7.0.0 through 7.14.0 and 6.7.0 through 6.30.3, certain URLs passed to the redirect function can trigger an open redirect to an external domain due to path values starting with // being reinterpreted as protocol-relative URLs. The level of impact...

SUSE CVE-2026-42211

React Router is a router for React. In versions 7.0.0 through 7.14.1, when using Framework Mode, a combination of steps could potentially allow unauthorized remote code execution RCE through external requests. This attack requires the application code to have an existing prototype pollution...

SUSE CVE-2026-42342

React Router is a router for React. In versions 7.0.0 through 7.14.x of react-router and versions 2.10.0 through 2.17.4 of @remix-run/server-runtime, certain crafted requests can consume disproportionate server resources via unbounded path expansion in the manifest endpoint, resulting in response...

31g-form-parser (1.0.107), @accounter/client (>=0.0.3-alpha-20241124130832-1498e8a00d2fa532e452b5ad126a753f4844a237, <=0.0.12-alpha-20260508071110-20f5becdec9522d09c6a97f123f7c572407661fb) +379 more potentially affected by CVE-2026-42342 +1 more via react-router (>=7.0.0, <=7.14.2)

react-router NPM version =7.0.0, =0.0.3-alpha-20241124130832-1498e8a00d2fa532e452b5ad126a753f4844a237, =1.3.7, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.0.2, =3.4.0, =2026.511.1, =0.2.3, =0.3.7 and more Source cves: CVE-2026-42342, CVE-2026-55685 Source advisory: OSV:GHSA-8X6R-G9MW-2R78...

React Router vulnerable to DoS via unbounded path expansion in __manifest endpoint

There exists a potential DOS attack vector in React Router Framework Mode applications as well as Remix v2.10.0 - 2.17.4. Certain requests can be crafted to consume disproportionate resources on the server, resulting in response time degredation and/or service unavailability for end users. !NOTE...

EUVD-2026-34000

React Router vulnerable to DoS via unbounded path expansion in manifest endpoint...

GHSA-8X6R-G9MW-2R78 React Router vulnerable to DoS via unbounded path expansion in __manifest endpoint

There exists a potential DOS attack vector in React Router Framework Mode applications as well as Remix v2.10.0 - 2.17.4. Certain requests can be crafted to consume disproportionate resources on the server, resulting in response time degredation and/or service unavailability for end users. !NOTE...

GHSA-49RJ-9FVP-4H2H React Router's vendored turbo-stream v2 allows arbitrary constructor invocation via TYPE_ERROR deserialization leading to Unauth RCE

When using React Router v7 in Framework Mode, there exists a combination of steps that could potentially allow unauthorized RCE through external requests. This first requires the application code to have an existing prototype pollution vulnerability. This can be leveraged into a 2-step attack in...

React Router's vendored turbo-stream v2 allows arbitrary constructor invocation via TYPE_ERROR deserialization leading to Unauth RCE

When using React Router v7 in Framework Mode, there exists a combination of steps that could potentially allow unauthorized RCE through external requests. This first requires the application code to have an existing prototype pollution vulnerability. This can be leveraged into a 2-step attack in...

EUVD-2026-33999

React Router's vendored turbo-stream v2 allows arbitrary constructor invocation via TYPEERROR deserialization leading to Unauth RCE...

31g-form-parser (1.0.107), @accounter/client (>=0.0.3-alpha-20241124130832-1498e8a00d2fa532e452b5ad126a753f4844a237, <=0.0.12-alpha-20260427054851-6925deba4595cf0c72d3875df0a094608b394a27) +294 more potentially affected by CVE-2026-42211 via react-router (>=7.0.0, <=7.14.1)

react-router NPM version =7.0.0, =0.0.3-alpha-20241124130832-1498e8a00d2fa532e452b5ad126a753f4844a237, =0.0.2, =3.4.0, =0.2.3, =1.1.0, =1.0.1-MON-198407-add-selinux-sudo-check.0, =0.0.1, =1.0.3, =1.0.8 and more Source cves: CVE-2026-42211 Source advisory: OSV:GHSA-49RJ-9FVP-4H2H...

GHSA-2J2X-HQR9-3H42 React Router's same-origin redirect with path starting // causes open redirect via protocol-relative URL reinterpretation

Certain URLs passed to the redirect function can trigger an open redirect to an external domain depending on the level of validation done by the application prior to returning the redirect. !NOTE This does not impact your React Router application if you are using Declarative Mode...

EUVD-2026-33996

React Router's same-origin redirect with path starting // causes open redirect via protocol-relative URL reinterpretation...

31g-form-parser (1.0.107), @accounter/client (>=0.0.3-alpha-20241124130832-1498e8a00d2fa532e452b5ad126a753f4844a237, <=0.0.12-alpha-20260421081155-bb6cc4c0b0b59fff41df172e2f4212eca6906193) +291 more potentially affected by CVE-2026-40181 via react-router (>=7.0.0, <=7.14.0-pre.0)

react-router NPM version =7.0.0, =0.0.3-alpha-20241124130832-1498e8a00d2fa532e452b5ad126a753f4844a237, =0.0.2, =3.4.0, =0.2.3, =1.1.0, =1.0.1-MON-198407-add-selinux-sudo-check.0, =0.0.1, =1.0.3, =1.0.8 and more Source cves: CVE-2026-40181 Source advisory: OSV:GHSA-2J2X-HQR9-3H42...

@1023-ventures/merope2 (>=0.2.1, <=0.2.9), @1023-ventures/vega-core (>=0.5.0, <=0.6.2) +1201 more potentially affected by CVE-2026-40181 via react-router (>=6.7.0, <=6.30.3-pre-v6.0)

react-router NPM version =6.7.0, =0.2.1, =0.5.0, =0.0.1, =0.0.1, =3.0.0, =0.0.0-beta-20260120211922, =1.0.0, =1.0.0, =1.0.0, =2.7.0, =0.0.1, =0.1.0, =0.0.0, =2.13.1, =2.13.94 and more Source cves: CVE-2026-40181 Source advisory: OSV:GHSA-2J2X-HQR9-3H42...

React Router's same-origin redirect with path starting // causes open redirect via protocol-relative URL reinterpretation

Certain URLs passed to the redirect function can trigger an open redirect to an external domain depending on the level of validation done by the application prior to returning the redirect. !NOTE This does not impact your React Router application if you are using Declarative Mode...

EUVD-2026-33988

React Router vulnerable to XSS in unstable RSC redirect handling via javascript: redirect targets...

GHSA-8646-J5J9-6R62 React Router vulnerable to XSS in unstable RSC redirect handling via javascript: redirect targets

When using React Router v7's unstable RSC APIs, there exists a potential client-side XSS issue in the RSC redirect handling if redirects are coming from untrusted sources !NOTE This only impacts your application if you are using the unstable RSC APIs in React Router...