@buttery/tokens (>=0.1.2, <=0.1.10), @common-stack/frontend-stack-react (>=6.0.6-alpha.23, <=10.0.1-alpha.0) +25 more potentially affected by CVE-2026-42342 via @remix-run/server-runtime (>=2.10.0, <=2.17.4)

@remix-run/server-runtime NPM version =2.10.0, =0.1.2, =6.0.6-alpha.23, =6.0.6-alpha.28, =0.1.0, =5.6.0, =5.13.0, =5.6.0, =5.6.0, =0.1.36, =2.10.0, =2.10.0, =2.10.0, =2.10.0, =2.10.0, =2.10.0, =2.17.4 and more Source cves: CVE-2026-42342 Source advisory: SNYK:JS-REMIXRUNSERVERRUNTIME-17138702...

CVE-2026-42342

React Router is a router for React. In versions 7.0.0 through 7.14.x of react-router and versions 2.10.0 through 2.17.4 of @remix-run/server-runtime, certain crafted requests can consume disproportionate server resources via unbounded path expansion in the manifest endpoint, resulting in response...

CVE-2026-42342

React Router is a router for React. In versions 7.0.0 through 7.14.x of react-router and versions 2.10.0 through 2.17.4 of @remix-run/server-runtime, certain crafted requests can consume disproportionate server resources via unbounded path expansion in the manifest endpoint, resulting in response...

@buttery/tokens (>=0.1.2, <=0.1.10), @common-stack/frontend-stack-react (>=6.0.6-alpha.23, <=10.0.1-alpha.0) +25 more potentially affected by CVE-2026-42342 via @remix-run/server-runtime (>=2.10.0, <=2.17.4)

@remix-run/server-runtime NPM version =2.10.0, =0.1.2, =6.0.6-alpha.23, =6.0.6-alpha.28, =0.1.0, =5.6.0, =5.13.0, =5.6.0, =5.6.0, =0.1.36, =2.10.0, =2.10.0, =2.10.0, =2.10.0, =2.10.0, =2.10.0, =2.17.4 and more Source cves: CVE-2026-42342 Source advisory: MEND:CVE-2026-42342...

CVE-2026-42342: Uncontrolled Resource Consumption

React Router is a router for React. In versions 7.0.0 through 7.14.x of react-router and versions 2.10.0 through 2.17.4 of @remix-run/server-runtime, certain crafted requests can consume disproportionate server resources via unbounded path expansion in the manifest endpoint, resulting in response...

PT-2026-45835

Name of the Vulnerable Software and Affected Versions react-router versions 7.0.0 through 7.14.x @remix-run/server-runtime versions 2.10.0 through 2.17.4 Description Certain crafted requests can cause disproportionate server resource consumption through unbounded path expansion at the manifest...

SUSE CVE-2026-22030

React Router is a router for React. In @remix-run/server-runtime version prior to 2.17.3. and react-router 7.0.0 through 7.11.0, React Router or Remix v2 is vulnerable to CSRF attacks on document POST requests to UI routes when using server-side route action handlers in Framework Mode, or when...

CVE-2026-22030

CVE-2026-22030 affects React Router in combination with Remix v2 server runtime in Framework Mode or with React Server Actions (RSC). The vulnerability allows CSRF on document POST requests to UI routes when using server-side route actions, with no impact in Declarative Mode () or Data Mode (crea...

CVE-2026-22030 React Router has CSRF issue in Action/Server Action Request Processing

React Router is a router for React. In @remix-run/server-runtime version prior to 2.17.3. and react-router 7.0.0 through 7.11.0, React Router or Remix v2 is vulnerable to CSRF attacks on document POST requests to UI routes when using server-side route action handlers in Framework Mode, or when...

@alola-react/app-tools (0.0.1), @alola-react/plugin-data-loader (0.0.1) +212 more potentially affected by CVE-2026-22030 via @remix-run/server-runtime (>=0.0.0-experimental-a04f3d18, <=2.17.2)

@remix-run/server-runtime NPM version =0.0.0-experimental-a04f3d18, =1.0.0, =0.1.0-RC.0, =1.0.0, =0.0.6, =0.1.2, =0.0.1, =1.0.0, =6.0.6-alpha.23, =10.0.1-alpha.0 and more Source cves: CVE-2026-22030 Source advisory: MEND:CVE-2026-22030...

CVE-2026-22030 React Router has CSRF issue in Action/Server Action Request Processing

React Router is a router for React. In @remix-run/server-runtime version prior to 2.17.3. and react-router 7.0.0 through 7.11.0, React Router or Remix v2 is vulnerable to CSRF attacks on document POST requests to UI routes when using server-side route action handlers in Framework Mode, or when...

@buttery/tokens (>=0.1.2, <=0.1.10), @common-stack/frontend-stack-react (>=6.0.6-alpha.23, <=10.0.1-alpha.0) +29 more potentially affected by CVE-2026-22030 via @remix-run/server-runtime (>=2.0.0-pre.0, <=2.17.2)

@remix-run/server-runtime NPM version =2.0.0-pre.0, =0.1.2, =6.0.6-alpha.23, =6.0.6-alpha.28, =2.9.1-dario-6, =0.1.0, =5.6.0, =5.13.0, =5.6.0, =5.6.0, =0.0.1-alpha.0, =2.0.0-pre.0, =2.0.0-pre.0, =2.0.0-pre.0, =2.0.0-pre.0, =2.0.0-pre.0, =2.17.2 and more Source cves: CVE-2026-22030 Source advisory...

@buttery/tokens (>=0.1.2, <=0.1.10), @common-stack/frontend-stack-react (>=6.0.6-alpha.23, <=10.0.1-alpha.0) +29 more potentially affected by CVE-2026-22030 via @remix-run/server-runtime (>=2.0.0-pre.0, <=2.17.2)

@remix-run/server-runtime NPM version =2.0.0-pre.0, =0.1.2, =6.0.6-alpha.23, =6.0.6-alpha.28, =2.9.1-dario-6, =0.1.0, =5.6.0, =5.13.0, =5.6.0, =5.6.0, =0.0.1-alpha.0, =2.0.0-pre.0, =2.0.0-pre.0, =2.0.0-pre.0, =2.0.0-pre.0, =2.0.0-pre.0, =2.17.2 and more Source cves: CVE-2026-22030 Source advisory...

@buttery/tokens (>=0.1.2, <=0.1.10), @common-stack/frontend-stack-react (>=6.0.6-alpha.23, <=10.0.1-alpha.0) +29 more potentially affected by CVE-2026-22030 via @remix-run/server-runtime (>=2.0.0-pre.0, <=2.17.2)

@remix-run/server-runtime NPM version =2.0.0-pre.0, =0.1.2, =6.0.6-alpha.23, =6.0.6-alpha.28, =2.9.1-dario-6, =0.1.0, =5.6.0, =5.13.0, =5.6.0, =5.6.0, =0.0.1-alpha.0, =2.0.0-pre.0, =2.0.0-pre.0, =2.0.0-pre.0, =2.0.0-pre.0, =2.0.0-pre.0, =2.17.2 and more Source cves: CVE-2026-22030 Source advisory...

Cross-site Request Forgery (CSRF)

Overview @remix-run/server-runtime is a Server runtime for Remix Affected versions of this package are vulnerable to Cross-site Request Forgery CSRF due to the improper origin checks of UI route submissions in server-side route action handlers in Framework Mode. An attacker can execute unauthoriz...

PT-2026-2138

Name of the Vulnerable Software and Affected Versions react-router versions 7.0.0 through 7.11.0 @remix-run/server-runtime versions prior to 2.17.3 Description React Router, used as a router for React applications, is susceptible to Cross-Site Request Forgery CSRF attacks. This affects document...

EUVD-2023-1019

Malicious code in bioql PyPI...

org.infinispan:infinispan-server-integration (12.1.4.final), org.infinispan:infinispan-server-integrationtests-commons (12.1.4.final) +5 more potentially affected by CVE-2025-5731 via org.infinispan:infinispan-cli-client (12.1.4.final)

org.infinispan:infinispan-cli-client MAVEN version 12.1.4.final is affected by a known vulnerability. The following packages have a transitive dependency on org.infinispan:infinispan-cli-client and may be impacted: - org.infinispan:infinispan-server-integration 12.1.4.final -...

org.infinispan:infinispan-server-integration (12.1.5.final), org.infinispan:infinispan-server-integrationtests-commons (12.1.5.final) +5 more potentially affected by CVE-2025-5731 via org.infinispan:infinispan-cli-client (12.1.5.final)

org.infinispan:infinispan-cli-client MAVEN version 12.1.5.final is affected by a known vulnerability. The following packages have a transitive dependency on org.infinispan:infinispan-cli-client and may be impacted: - org.infinispan:infinispan-server-integration 12.1.5.final -...

org.infinispan:infinispan-server-integration (12.1.10.final), org.infinispan:infinispan-server-integrationtests-commons (12.1.10.final) +5 more potentially affected by CVE-2025-5731 via org.infinispan:infinispan-cli-client (12.1.10.final)

org.infinispan:infinispan-cli-client MAVEN version 12.1.10.final is affected by a known vulnerability. The following packages have a transitive dependency on org.infinispan:infinispan-cli-client and may be impacted: - org.infinispan:infinispan-server-integration 12.1.10.final -...