vulnerability-in-Remix-React-Router-CVE-2025-31137-

개요 @zhero의 개인 블로그 게시물에 있는 writeup을 읽은 후, 어떻게 작동하는지 배우기 위해 이 CTF를 만들기로 결정했고, 그 후 이 취약점을 악용하는 방법을 배우고 싶은 사람과 공유하기로 했습니다. [email protected] 버전으로 CTF를 만들려고 했지만, @remix-run/express를 확인했을 때 코드가 패치된 것을 발견하고 GitHub에서 취약한 코드를 복사하여 붙여넣었으므로 아래 설명대로 @remix-run/express 패키지의 코드를 변경해야 합니다. 목표 admin 페이지에서...

CVE-2015-8351_Otter_Remix

이 저장소에는 README가 없습니다...

tricorne

Tricorne 공격 보안을 위한 Fedora 리믹스. "내 보물? 원한다면 가져가게. 찾아내라! 나는 모든 것을 그곳에 두고 왔다!" 골 D. 로저 짧은 버전 Kali는 Debian을 소유하고 있습니다. BlackArch는 Arch를 소유합니다. Parrot은 "보안 중심 데스크톱" 분야를 소유합니다. RPM 세계의 공격 보안을 소유한 사람은 아무도 없습니다 , Fedora가 아마도 가장 방어적으로 강화된 주류 배포판임에도 불구하고 말이죠. Tricorne이 그 격차를 메웁니다. 이것은 Fedora의 기본 설정인 SELinu...

CLSA-2026-1789597929 TuxCare security update for @remix-run/router (1 CVE)

TuxCare rebuilt @remix-run/router to address 1 CVE. Fixed in 1.23.0-tuxcare.3...

CLSA-2026-1781052757 TuxCare security update for @remix-run/router (3 CVEs)

TuxCare rebuilt @remix-run/router to address 3 CVEs. Fixed in 1.15.3-tuxcare.1...

react-router: @remix-run/server-runtime: React Router / Remix: Denial of Service via unbounded path expansion in __manifest endpoint

A flaw was found in React Router and @remix-run/server-runtime. A remote attacker can exploit this vulnerability by sending certain crafted requests to the manifest endpoint. This can lead to unbounded path expansion, consuming disproportionate server resources. The primary consequence is a denia...

SUSE CVE-2025-61686

React Router is a router for React. In @react-router/node versions 7.0.0 through 7.9.3, @remix-run/deno prior to version 2.17.2, and @remix-run/node prior to version 2.17.2, if createFileSessionStorage is being used from @react-router/node or @remix-run/node/@remix-run/deno in Remix v2 with an...

Linux Distros Unpatched Vulnerability : CVE-2026-42342

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - React Router is a router for React. In versions 7.0.0 through 7.14.x of react-router and versions 2.10.0 through 2.17.4 of @remix-run/server-runtime, certain...

CVE-2026-42342

A flaw was found in React Router and @remix-run/server-runtime. A remote attacker can exploit this vulnerability by sending certain crafted requests to the manifest endpoint. This can lead to unbounded path expansion, consuming disproportionate server resources. The primary consequence is a denia...

@remix-run/architect (>=2.17.3, <=2.17.4), @remix-run/cloudflare (>=2.17.3, <=2.17.4) +10 more potentially affected by CVE-2026-53663 via @remix-run/server-runtime (>=2.17.3, <=2.17.4)

@remix-run/server-runtime NPM version =2.17.3, =2.17.3, =2.17.3, =2.17.3, =2.17.3, =2.17.3, =2.17.3, =2.17.3, =2.17.3, =2.17.3, =2.17.3, =2.17.3, =0.11.30, =0.12.30 Source cves: CVE-2026-53663 Source advisory: SNYK:JS-REMIXRUNSERVERRUNTIME-17342509...

@remix-run/architect (>=2.17.3, <=2.17.4), @remix-run/cloudflare (>=2.17.3, <=2.17.4) +10 more potentially affected by CVE-2026-53663 via @remix-run/server-runtime (>=2.17.3, <=2.17.4)

@remix-run/server-runtime NPM version =2.17.3, =2.17.3, =2.17.3, =2.17.3, =2.17.3, =2.17.3, =2.17.3, =2.17.3, =2.17.3, =2.17.3, =2.17.3, =2.17.3, =0.11.30, =0.12.30 Source cves: CVE-2026-53663 Source advisory: OSV:GHSA-84G9-W2XQ-VCV6...

Cross-site Request Forgery (CSRF)

Overview @remix-run/server-runtime is a Server runtime for Remix Affected versions of this package are vulnerable to Cross-site Request Forgery CSRF due to insufficient CSRF checks for PUT, PATCH, and DELETE document requests. An attacker can cause unauthorized state changes by tricking a user in...

CVE-2026-44483

RVF formerly Remix Validated Form provides easy form validation and state management for React. From 6.0.0 to before 6.0.4 and 7.0.2, setPath in @rvf/set-get used by @rvf/core to flatten incoming form data into a nested object does not block the keys proto, constructor, or prototype when walking ...

React Router vulnerable to Denial of Service via reflected user input in single-fetch

A DoS vulnerability exists in the React Router v7 Framework Mode, as well as Remix v2.9.0+ with Single Fetch enabled. In some scenarios the underlying serialization algorithm can become a bottleneck when encoding specific types of data into server responses. Please upgrade to React Router v7.14.0...

GHSA-RXV8-25V2-QMQ8 React Router vulnerable to Denial of Service via reflected user input in single-fetch

A DoS vulnerability exists in the React Router v7 Framework Mode, as well as Remix v2.9.0+ with Single Fetch enabled. In some scenarios the underlying serialization algorithm can become a bottleneck when encoding specific types of data into server responses. Please upgrade to React Router v7.14.0...

SUSE CVE-2026-42342

React Router is a router for React. In versions 7.0.0 through 7.14.x of react-router and versions 2.10.0 through 2.17.4 of @remix-run/server-runtime, certain crafted requests can consume disproportionate server resources via unbounded path expansion in the manifest endpoint, resulting in response...

React Router vulnerable to DoS via unbounded path expansion in __manifest endpoint

There exists a potential DOS attack vector in React Router Framework Mode applications as well as Remix v2.10.0 - 2.17.4. Certain requests can be crafted to consume disproportionate resources on the server, resulting in response time degredation and/or service unavailability for end users. !NOTE...

EUVD-2026-34000

React Router vulnerable to DoS via unbounded path expansion in manifest endpoint...

GHSA-8X6R-G9MW-2R78 React Router vulnerable to DoS via unbounded path expansion in __manifest endpoint

There exists a potential DOS attack vector in React Router Framework Mode applications as well as Remix v2.10.0 - 2.17.4. Certain requests can be crafted to consume disproportionate resources on the server, resulting in response time degredation and/or service unavailability for end users. !NOTE...

@1023-ventures/merope2 (>=0.2.1, <=0.2.9), @1023-ventures/vega-core (>=0.5.0, <=0.6.2) +1334 more potentially affected by CVE-2026-40181 via @remix-run/router (>=1.3.0, <=1.23.2-pre-v6.0)

@remix-run/router NPM version =1.3.0, =0.2.1, =0.5.0, =0.0.1, =0.0.1, =3.0.0, =0.0.0-beta-20260120211922, =1.0.0, =1.0.0, =1.0.0, =2.7.0, =0.0.1, =0.1.0, =0.0.0, =2.13.1, =2.13.94 and more Source cves: CVE-2026-40181 Source advisory: OSV:GHSA-2J2X-HQR9-3H42...