Malicious code in @spx-delivery/react (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b03f32e2859ef16f71897fc985589e436c704979df087b57bb61fedb63e89c51 The package @spx-delivery/react was found to contain malicious code. Source: ghsa-malware...

MAL-2026-261 Malicious code in @spx-delivery/react (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b03f32e2859ef16f71897fc985589e436c704979df087b57bb61fedb63e89c51 The package @spx-delivery/react was found to contain malicious code. Source: ghsa-malware...

EUVD-2026-3110

Malicious code in @riag-libs/pattern-library-react-hooks npm...

MAL-2026-259 Malicious code in @riag-libs/pattern-library-react-hooks (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 64366b918bd4380cf8b087a445df7d86ef18b21686c577a9ed7bdd523aceac64 The package @riag-libs/pattern-library-react-hooks was found to contain malicious code. Source: ghsa-malware...

MAL-2026-273 Malicious code in chakra-ui-2--react-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5d8e94e720f2e969a3349854427d9ac418ea507516a488bc52eef4397d86e5e8 The package chakra-ui-2--react-utils was found to contain malicious code. Source: ghsa-malware...

Malicious code in react-sitecore-library (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7bcb38af52d8a28ad89a31c0415f1673eb2ca18ec76121703ded6334a6b7e6d2 The package react-sitecore-library was found to contain malicious code. Source: ghsa-malware...

Open Redirect

React Router is vulnerable to Open Redirect. The vulnerability is due to insufficient validation of attacker-supplied navigation paths, which allows an attacker to craft a malicious path that forces the application to redirect users to an external, potentially malicious URL...

Exploit for Deserialization of Untrusted Data in Facebook React

CVE-2025-55184CVE-...

CVE-2026-22030

React Router is a router for React. In @remix-run/server-runtime version prior to 2.17.3. and react-router 7.0.0 through 7.11.0, React Router or Remix v2 is vulnerable to CSRF attacks on document POST requests to UI routes when using server-side route action handlers in Framework Mode, or when...

CVE-2025-68470

React Router is a router for React. In versions 6.0.0 through 6.30.1 and 7.0.0 through 7.9.5, an attacker-supplied path can be crafted so that when a React Router application navigates to it via navigate, , or redirect, the app performs a navigation/redirect to an external URL. This is only an...

Exploit for Deserialization of Untrusted Data in Facebook React

CVE-2025-55182 Proof of concept exploit for CVE-2025-55182...

SUSE CVE-2026-21884

React Router is a router for React. In @remix-run/react version prior to 2.17.3. and react-router 7.0.0 through 7.11.0, a XSS vulnerability exists in in React Router's API in Framework Mode when using the getKey/storageKey props during Server-Side Rendering which could allow arbitrary JavaScript...

SUSE CVE-2026-22029

React Router is a router for React. In @remix-run/router version prior to 1.23.2 and react-router 7.0.0 through 7.11.0, React Router and Remix v1/v2 SPA open navigation redirects originating from loaders or actions in Framework Mode, Data Mode, or the unstable RSC modes can result in unsafe URLs...

SUSE CVE-2026-22030

React Router is a router for React. In @remix-run/server-runtime version prior to 2.17.3. and react-router 7.0.0 through 7.11.0, React Router or Remix v2 is vulnerable to CSRF attacks on document POST requests to UI routes when using server-side route action handlers in Framework Mode, or when...

Mitigating Denial-of-Service Vulnerability from Unrecoverable Stack Space Exhaustion for React, Next.js, and APM Users

Mitigating Denial-of-Service Vulnerability from Unrecoverable Stack Space Exhaustion for React, Next.js, and APM Users TL;DR Node.js/V8 makes a best-effort attempt to recover from stack space exhaustion with a catchable error, which frameworks have come to rely on for service availability. An edg...

Linux Distros Unpatched Vulnerability : CVE-2025-68470

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - React Router is a router for React. In versions 6.0.0 through 6.30.1 and 7.0.0 through 7.9.5, an attacker- supplied path can be crafted so that when a React...

Linux Distros Unpatched Vulnerability : CVE-2026-22030

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - React Router is a router for React. In @remix-run/server-runtime version prior to 2.17.3. and react-router 7.0.0 through 7.11.0, React Router or Remix v2 is...

CVE-2025-61686

A security issue was discovered in the react-router/node component of React Router. It is possible for an attacker manipulate an unsigned cookie to cause the session to try to read/write from a location outside the specified session file directory. The success of the attack would depend on the...

Cross-site Scripting (XSS)

React Router is vulnerable to Cross-Site Scripting XSS. The vulnerability is due to improper handling of untrusted input in the API during server-side rendering when generating keys via the getKey or storageKey props, which allows an attacker to inject and execute arbitrary JavaScript...

Path Traversal

React Router is vulnerable to Path Traversal. The vulnerability is due to the use of createFileSessionStorage with an unsigned cookie, which allows an attacker to manipulate session identifiers to attempt read/write operations outside the intended session file directory, potentially accessing...