fix(deps): update dependency react-router to v7.18.2 [security] (v2) - #8833
Open
renovate[bot] wants to merge 1 commit into
Open
fix(deps): update dependency react-router to v7.18.2 [security] (v2)#8833renovate[bot] wants to merge 1 commit into
renovate[bot] wants to merge 1 commit into
Conversation
|
❌ Deploy Preview for modernjs-v2 failed. Why did it fail? →
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
7.15.1→7.18.2React Router vulnerable to XSS in unstable RSC redirect handling via javascript: redirect targets
CVE-2026-33245 / GHSA-8646-j5j9-6r62
More information
Details
When using React Router v7's unstable RSC APIs, there exists a potential client-side XSS issue in the RSC redirect handling if redirects are coming from untrusted sources
Severity
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:NReferences
This data is provided by the GitHub Advisory Database (CC-BY 4.0).
React Router has stored XSS via unescaped Location header in prerendered redirect HTML
CVE-2026-33244 / GHSA-f22v-gfqf-p8f3
More information
Details
When using React Router v7 Framework Mode with Pre-rendering enabled, an improper neutralization of the HTTP
Locationheader value can permit Cross-Site Scripting (XSS) in statically generated HTML files if the redirect location comes from an untrusted source.Severity
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:NReferences
This data is provided by the GitHub Advisory Database (CC-BY 4.0).
React Router's vendored turbo-stream v2 allows arbitrary constructor invocation via TYPE_ERROR deserialization leading to Unauth RCE
CVE-2026-42211 / GHSA-49rj-9fvp-4h2h
More information
Details
When using React Router v7 in Framework Mode, there exists a combination of steps that could potentially allow unauthorized RCE through external requests. This first requires the application code to have an existing prototype pollution vulnerability. This can be leveraged into a 2-step attack in which the second step can trigger unauthorized RCE on the remote server.
Severity
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:HReferences
This data is provided by the GitHub Advisory Database (CC-BY 4.0).
React Router's same-origin redirect with path starting // causes open redirect via protocol-relative URL reinterpretation
CVE-2026-40181 / GHSA-2j2x-hqr9-3h42
More information
Details
Certain URLs passed to the
redirectfunction can trigger an open redirect to an external domain depending on the level of validation done by the application prior to returning theredirect.Severity
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:UReferences
This data is provided by the GitHub Advisory Database (CC-BY 4.0).
React Router vulnerable to DoS via unbounded path expansion in __manifest endpoint
CVE-2026-42342 / GHSA-8x6r-g9mw-2r78
More information
Details
There exists a potential DOS attack vector in React Router Framework Mode applications (as well as Remix v2.10.0 - 2.17.4). Certain requests can be crafted to consume disproportionate resources on the server, resulting in response time degredation and/or service unavailability for end users.
Severity
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HReferences
This data is provided by the GitHub Advisory Database (CC-BY 4.0).
React Router vulnerable to Denial of Service via reflected user input in single-fetch
CVE-2026-34077 / GHSA-rxv8-25v2-qmq8
More information
Details
A DoS vulnerability exists in the React Router v7 Framework Mode, as well as Remix v2.9.0+ with Single Fetch enabled. In some scenarios the underlying serialization algorithm can become a bottleneck when encoding specific types of data into server responses. Please upgrade to React Router v7.14.0 or later.
Severity
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HReferences
This data is provided by the GitHub Advisory Database (CC-BY 4.0).
React Router: Potential CSRF via PUT/PATCH/DELETE document requests
CVE-2026-53663 / GHSA-84g9-w2xq-vcv6
More information
Details
Certain CSRF checks in React Router v7 Framework Mode were insufficient and run on POST requests, but were bypassed on PUT/PATCH/DELETE requests. This is a low severity vulnerability because modern browser protections (CORS preflight, SameSite cookies) already block the cross-origin attack vectors that this missing CSRF check would otherwise gate.
Severity
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:NReferences
This data is provided by the GitHub Advisory Database (CC-BY 4.0).
React Router: RSCErrorHandler Missing Protocol Validation (XSS)
CVE-2026-53667 / GHSA-h8fp-f39c-q6mh
More information
Details
This is a follow up to GHSA-8646-j5j9-6r62. React Router was alerted of a code path in the (unstable) RSC error handling path in which redirects from untrusted sources could still result in an XSS vector via attacker-supplied redirect targets
Severity
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:L/A:NReferences
This data is provided by the GitHub Advisory Database (CC-BY 4.0).
React Router: Arbitrary Constructor Injection via deserializeErrors() in React Router SSR Hydration
CVE-2026-53666 / GHSA-337j-9hxr-rhxg
More information
Details
If application code allows attacker supplied input to overwrite certain aspects of errors caught by the SSR process, then it was possible for attacker to trigger unexpected constructor execution on the client which would trigger outbound network traffic. This is only possible with very specific (and unlikely) application layer code.
Severity
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:NReferences
This data is provided by the GitHub Advisory Database (CC-BY 4.0).
React Router: Open redirect via backslash in and useNavigate (CVE-2025-68470 bypass)
CVE-2026-53669 / GHSA-wrjc-x8rr-h8h6
More information
Details
This is a follow up to CVE-2025-68470. React Router was alerted to certain scenarios in which the fix there was incomplete so there still existed some scenarios where attacker supplied paths passed to navigation mechanisms could result in unexpected external navigations.
Severity
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:L/SI:L/SA:NReferences
This data is provided by the GitHub Advisory Database (CC-BY 4.0).
React Router: Unauthenticated Denial of Service via Inefficient Route Matching
CVE-2026-55685 / GHSA-chx6-hx7r-mcp5
More information
Details
This is a follow up to GHSA-8x6r-g9mw-2r78 that covers additional reported scenarios in which the manifest endpoint could be accessed via unauthenticated targeted requests that would put heavy load on the server and slow down response times.
Severity
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:NReferences
This data is provided by the GitHub Advisory Database (CC-BY 4.0).
React Router: RSC Mode CSRF Bypass Allows Action Execution Before 400 Response
GHSA-qwww-vcr4-c8h2
More information
Details
This is a follow up to CVE-2026-22030 to address related CSRF flows in unstable RSC code paths.
Severity
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:N/SC:N/SI:N/SA:NReferences
This data is provided by the GitHub Advisory Database (CC-BY 4.0).
Release Notes
remix-run/react-router (react-router)
v7.18.2: v7.18.2Compare Source
See the changelog for release notes: https://github.com/remix-run/react-router/blob/v7/CHANGELOG.md#v7182
v7.18.1: v7.18.1Compare Source
See the changelog for release notes: https://github.com/remix-run/react-router/blob/v7/CHANGELOG.md#v7181
v7.18.0Compare Source
Patch Changes
ssr: falseandfuture.v8_trailingSlashAwareDataRequests: true. Avoids false positive "SPA Mode" detection when serving prerendered paths (#15173)ServerRouternonce for nonce-aware SSR components when they don't provide their own value so strict CSP pages can load them. (#15170)turbo-streamto serialize and deserialize Framework Mode hydration errors (#15175)v7.17.0Compare Source
Minor Changes
Ship a subset of the official documentation inside the
react-routerpackage (#15121)node_modules/react-router/docs, letting AI coding agents and the React Router agent skills read official docs locallyapi/),community/content, and tutorials (tutorials/)v7.16.0Compare Source
Minor Changes
future.unstable_trailingSlashAwareDataRequestsasfuture.v8_trailingSlashAwareDataRequests(#15098)Patch Changes
Disable manifest path when lazy route dicovery is disabled (#15068)
Fix browser URL creation to use the configured history window instead of the global window. (#15066)
createBrowserURLImplso custom window contexts keep the correct URL origin.Fix
useNavigation()return type to preserve discriminated union across navigation states (#15095)Widen
MetaDescriptorscript:ld+jsontype fromLdJsonObjecttoLdJsonObject | LdJsonObject[]to permit multiple JSON-LD schemas in a single<script type="application/ld+json">tag emitted by<Meta />(#15082)Configuration
📅 Schedule: (UTC)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR was generated by Mend Renovate. View the repository job log.