remix-run vulnerabilities

CVEs per yearBy the year they were published

1. 20253
2. 202618

Newest CVEs

• CVE-2026-53669

  React Router: Open redirect via backslash in <Link> and useNavigate (CVE-2025-68470 bypass)

  remix-run · react-router

  Medium5.1
• CVE-2026-55685

  React Router: Unauthenticated Denial of Service via Inefficient Route Matching

  remix-run · react-router

  High8.7
• CVE-2026-53668

  React Router: Open redirect can lead to XSS

  remix-run · react-router

  Medium6.9
• CVE-2026-53667

  React Router: Cross-site Scripting is Possible due to Missing RSCErrorHandler Protocol Validation (Incomplete fix for CVE-2026-53667)

  remix-run · react-router

  Medium6.9
• CVE-2026-53666

  React Router: Arbitrary Constructor Injection via deserializeErrors() in React Router SSR Hydration

  remix-run · react-router

  Medium6.1
• CVE-2026-53663

  React Router: `handleDocumentRequest` CSRF check covers `POST` only; PUT/PATCH/DELETE bypass

  remix-run · react-router

  Low3.1
• CVE-2026-42342

  React Router vulnerable to DoS via unbounded path expansion in __manifest endpoint

  remix-run · react-router

  High7.5
• CVE-2026-42211

  React Router's vendored turbo-stream v2 allows arbitrary constructor invocation via TYPE_ERROR deserialization leading to Unauth RCE

  remix-run · react-router

  High8.1
• CVE-2026-40181

  React Router's same-origin redirect with path starting // causes open redirect via protocol-relative URL reinterpretation

  remix-run · react-router

  Medium6.6
• CVE-2026-34077

  React Router vulnerable to Denial of Service via reflected user input in single-fetch

  remix-run · react-router

  High7.5