CVE-2026-22029

React Router is a router for React. In @remix-run/router version prior to 1.23.2 and react-router 7.0.0 through 7.11.0, React Router and Remix v1/v2 SPA open navigation redirects originating from loaders or actions in Framework Mode, Data Mode, or the unstable RSC modes can result in unsafe URLs...

CVE-2026-22029 React Router vulnerable to XSS via Open Redirects

React Router is a router for React. In @remix-run/router version prior to 1.23.2 and react-router 7.0.0 through 7.11.0, React Router and Remix v1/v2 SPA open navigation redirects originating from loaders or actions in Framework Mode, Data Mode, or the unstable RSC modes can result in unsafe URLs...

CVE-2026-22029

CVE-2026-22029 stems from React Router/Remix Router open redirects in framework-mode redirects. Affected: @remix-run/router <1.23.2 and react-router <7.12.0 (7.0.0–7.11.0). Impact: unsafe URLs and potentially unintended JavaScript execution on the client when redirects originate from loader...

CVE-2026-21884

CVE-2026-21884 is a Cross-Site Scripting (XSS) vulnerability in React Router SSR usage. Affected: @remix-run/react prior to 2.17.3 and react-router 7.0.0–7.11.0. Root cause: during Server-Side Rendering in Framework Mode, using getKey/storageKey with can allow arbitrary JavaScript execution if u...

CVE-2026-21884 React Router SSR XSS in ScrollRestoration

React Router is a router for React. In @remix-run/react version prior to 2.17.3. and react-router 7.0.0 through 7.11.0, a XSS vulnerability exists in in React Router's API in Framework Mode when using the getKey/storageKey props during Server-Side Rendering which could allow arbitrary JavaScript...

@b42inc/remix-i18n (0.0.1), @briandlee/remix-return-navigation (>=1.0.0-post, <=1.1.0-dev0) +71 more potentially affected by CVE-2026-21884 via @remix-run/react (>=0.0.0-experimental-a7ab46039, <=2.17.2)

@remix-run/react NPM version =0.0.0-experimental-a7ab46039, =1.0.0-post, =0.1.2, =1.0.0, =6.0.6-alpha.23, =0.0.2-alpha.0, =0.0.1, =0.0.1, =0.1.0, =1.0.0, =0.0.22, =0.0.6, =0.1.0, =0.0.1, =5.0.4 and more Source cves: CVE-2026-21884 Source advisory: MEND:CVE-2026-21884...

CVE-2026-21884 React Router SSR XSS in ScrollRestoration

React Router is a router for React. In @remix-run/react version prior to 2.17.3. and react-router 7.0.0 through 7.11.0, a XSS vulnerability exists in in React Router's API in Framework Mode when using the getKey/storageKey props during Server-Side Rendering which could allow arbitrary JavaScript...

CVE-2026-21884 React Router SSR XSS in ScrollRestoration

React Router is a router for React. In @remix-run/react version prior to 2.17.3. and react-router 7.0.0 through 7.11.0, a XSS vulnerability exists in in React Router's API in Framework Mode when using the getKey/storageKey props during Server-Side Rendering which could allow arbitrary JavaScript...

CVE-2025-61686 React Router has Path Traversal in File Session Storage

React Router is a router for React. In @react-router/node versions 7.0.0 through 7.9.3, @remix-run/deno prior to version 2.17.2, and @remix-run/node prior to version 2.17.2, if createFileSessionStorage is being used from @react-router/node or @remix-run/node/@remix-run/deno in Remix v2 with an...

@alola-react/app-tools (0.0.1), @alola-react/plugin-data-loader (0.0.1) +154 more potentially affected by CVE-2025-61686 via @remix-run/node (>=0.0.0-experimental-a04f3d18, <=2.17.1)

@remix-run/node NPM version =0.0.0-experimental-a04f3d18, =1.0.0, =0.1.0-RC.0, =1.0.0, =0.1.2, =0.0.1, =1.0.0, =6.0.6-alpha.23, =6.0.6-alpha.28, =0.0.2-alpha.0, =1.0.3-y.34, =1.0.3-y.49 and more Source cves: CVE-2025-61686 Source advisory: MEND:CVE-2025-61686...

universal-lib-template (>=1.0.22, <=1.0.23) potentially affected by CVE-2025-61686 via @remix-run/deno (1.19.3)

@remix-run/deno NPM version 1.19.3 is affected by a known vulnerability. The following packages have a transitive dependency on @remix-run/deno and may be impacted: - universal-lib-template =1.0.22, =1.0.23 Source cves: CVE-2025-61686 Source advisory: MEND:CVE-2025-61686...

CVE-2025-61686

React Router is a router for React. In @react-router/node versions 7.0.0 through 7.9.3, @remix-run/deno prior to version 2.17.2, and @remix-run/node prior to version 2.17.2, if createFileSessionStorage is being used from @react-router/node or @remix-run/node/@remix-run/deno in Remix v2 with an...

CVE-2025-61686 React Router has Path Traversal in File Session Storage

React Router is a router for React. In @react-router/node versions 7.0.0 through 7.9.3, @remix-run/deno prior to version 2.17.2, and @remix-run/node prior to version 2.17.2, if createFileSessionStorage is being used from @react-router/node or @remix-run/node/@remix-run/deno in Remix v2 with an...

CVE-2025-61686 React Router has Path Traversal in File Session Storage

React Router is a router for React. In @react-router/node versions 7.0.0 through 7.9.3, @remix-run/deno prior to version 2.17.2, and @remix-run/node prior to version 2.17.2, if createFileSessionStorage is being used from @react-router/node or @remix-run/node/@remix-run/deno in Remix v2 with an...

@b42inc/remix-i18n (0.0.1), @briandlee/remix-return-navigation (>=1.0.0-post, <=1.1.0-dev0) +68 more potentially affected by CVE-2025-59057 via @remix-run/react (>=1.15.0, <=2.17.0)

@remix-run/react NPM version =1.15.0, =1.0.0-post, =0.1.2, =1.0.0, =6.0.6-alpha.23, =0.0.2-alpha.0, =0.0.1, =0.0.1, =0.1.0, =1.0.0, =0.0.22, =0.0.6, =0.0.1, =5.6.0, =5.28.0 and more Source cves: CVE-2025-59057 Source advisory: MEND:CVE-2025-59057...

CVE-2025-59057 React Router has XSS Vulnerability

React Router is a router for React. In @remix-run/react versions 1.15.0 through 2.17.0. and react-router versions 7.0.0 through 7.8.2, a XSS vulnerability exists in in React Router's meta/ APIs in Framework Mode when generating script:ld+json tags which could allow arbitrary JavaScript execution...

CVE-2025-59057 React Router has XSS Vulnerability

React Router is a router for React. In @remix-run/react versions 1.15.0 through 2.17.0. and react-router versions 7.0.0 through 7.8.2, a XSS vulnerability exists in in React Router's meta/ APIs in Framework Mode when generating script:ld+json tags which could allow arbitrary JavaScript execution...

CVE-2025-59057 React Router has XSS Vulnerability

React Router is a router for React. In @remix-run/react versions 1.15.0 through 2.17.0. and react-router versions 7.0.0 through 7.8.2, a XSS vulnerability exists in in React Router's meta/ APIs in Framework Mode when generating script:ld+json tags which could allow arbitrary JavaScript execution...

CVE-2026-22030: Origin Validation Error

React Router is a router for React. In @remix-run/server-runtime version prior to 2.17.3. and react-router 7.0.0 through 7.11.0, React Router or Remix v2 is vulnerable to CSRF attacks on document POST requests to UI routes when using server-side route action handlers in Framework Mode, or when...

CVE-2026-22029: Improper Neutralization of Input During Web Page Generation

React Router is a router for React. In @remix-run/router version prior to 1.23.2 and react-router 7.0.0 through 7.11.0, React Router and Remix v1/v2 SPA open navigation redirects originating from loaders or actions in Framework Mode, Data Mode, or the unstable RSC modes can result in unsafe URLs...