react-router
8.5.1Declarative routing for React
- Maintenance
- Active183 commits in 3 months · bus factor 3
- License
- MITPermissive · OSI-approved
- Security
- 22 advisories1 critical, 11 high, 9 medium, 1 low · Scorecard 5.9/10
- Supported versions
- No scheduleendoflife.date does not track this project
56.6k stars · 11k forks · 228 open issues · last release 18 days ago · data checked 51 minutes ago
Security advisories
All advisories on GitHubThe 22 most recent advisories published by the maintainers: 1 critical, 11 high, 9 medium, 1 low. Check the patched version against the one you run.
- mediumGHSA-qwww-vcr4-c8h2Jul 22, 2026RSC Mode CSRF Bypass Allows Action Execution Before 400 Response
- Affected
- >= 7.12.0, < 7.18.2; >= 8.0.0, < 8.3.0
- Patched in
- 7.18.2; 8.3.0
- mediumCVE-2026-53668Jul 22, 2026Open redirect leading to XSS
- Affected
- >=6.30.2,<=6.30.4; >=7.9.6,<=7.12.0
- Patched in
- >=6.30.6; >=7.13.0
- highCVE-2026-55685Jul 22, 2026Unauthenticated Denial of Service in React Router __manifest endpoint
- Affected
- >=7.0.0,< 7.18.0
- Patched in
- >=7.18.0
- mediumCVE-2026-53667Jul 22, 2026RSCErrorHandler Missing Protocol Validation (XSS)
- Affected
- >=7.11.0,<7.18.0
- Patched in
- >=7.18.0
- mediumCVE-2026-53666Jul 22, 2026Arbitrary client-side constructor injection via React Router SSR Hydration
- Affected
- >= 6.4.0,<7.18.0
- Patched in
- >=7.18.0
- mediumCVE-2026-53669Jul 22, 2026Unexpected external redirect via untrusted paths (CVE-2025-68470 bypass)
- Affected
- >= 6.0.0,<7.18.0
- Patched in
- >=7.18.0
- lowCVE-2026-53663Jun 2, 2026Potential CSRF via PUT/PATCH/DELETE document requests
- Affected
- >=7.12.0,<7.15.1; >=2.17.3,<2.17.5
- Patched in
- >=7.15.1; >=2.17.5
- highCVE-2026-42211Jun 2, 2026Potential RCE via 2-step attack chained onto existing prototype pollution vulnerability
- Affected
- >= 7.0.0,<= 7.14.1
- Patched in
- >=7.14.2
- mediumCVE-2026-40181Jun 2, 2026Same-origin redirect with path starting // causes open redirect via protocol-relative URL reinterpretation
- Affected
- >=7.0.0,<7.14.1; >=6.7.0,<6.30.4; >=1.3.0,<1.23.3
- Patched in
- >=7.14.1; >=6.30.4; >1.23.3
- highCVE-2026-42342Jun 2, 2026DoS via unbounded path expansion in __manifest endpoint
- Affected
- >=7.0.0,<7.15.0; >=2.10.0,<2.17.5
- Patched in
- >=7.15.0; >=2.17.5
- highCVE-2026-33245Jun 2, 2026XSS in unstable RSC redirect handling via javascript: redirect targets
- Affected
- >=7.7.0,<7.13.2
- Patched in
- >=7.13.2
- mediumCVE-2026-33244Jun 2, 2026Stored XSS via unescaped Location header in prerendered redirect HTML
- Affected
- >=7.5.1,<7.13.2
- Patched in
- >=7.13.2
- highCVE-2026-34077Jun 2, 2026Denial of Service via reflected user input in single-fetch
- Affected
- <=2.4.1; >=7.0.0,<7.14.0
- Patched in
- >=3.0.0; >=7.14.0
- highCVE-2026-21884Jan 8, 2026React Router SSR XSS in ScrollRestoration
- Affected
- >=7.0.0,<=7.11.0; <=2.17.2
- Patched in
- >=7.12.0; >=2.17.3
- highCVE-2026-22029Jan 8, 2026XSS via Open Redirects
- Affected
- >=7.0.0,<=7.11.0; <=1.23.1
- Patched in
- >=7.12.0; >=1.23.2
- mediumCVE-2026-22030Jan 8, 2026CSRF in React Router Action/Server Action Request Processing
- Affected
- >=7.0.0,<7.12.0; <2.17.3
- Patched in
- >=7.12.0; >=2.17.3
- mediumCVE-2025-68470Jan 8, 2026Unexpected external redirect via untrusted paths
- Affected
- >=6.0.0,<=6.30.1; >=7.0.0,<=7.9.5
- Patched in
- >=6.30.2,<7.0.0; >=7.9.6
- criticalCVE-2025-61686Jan 8, 2026Unauthorized file access when using `createFileSessionStorage()` with unsigned cookies
- Affected
- >= 7.0.0, <=7.9.3; <=2.17.1
- Patched in
- >=7.9.4; >=2.17.2
- highCVE-2025-59057Jan 8, 2026XSS via Meta component when generating script:ld+json tags
- Affected
- >=7.0.0, <=7.8.2; >=1.15.0, <=2.17.0
- Patched in
- >=7.9.0; >=2.17.1
- highCVE-2025-43865Apr 24, 2025Pre-render data spoofing on React-Router framework mode
- Affected
- >= 7.0, <= 7.5.1
- Patched in
- 7.5.2
- highCVE-2025-43864Apr 24, 2025DoS via cache poisoning by forcing SPA mode
- Affected
- >= 7.2.0, <= 7.5.1
- Patched in
- 7.5.2
- highCVE-2025-31137Apr 1, 2025URL manipulation via Host / X-Forwarded-Host headers
- Affected
- 7.0.0-7.4.0; >=2.11.1
- Patched in
- 7.4.1; 2.16.3