CVE-2026-22029

What it actually does

The flaw is an unsafe client-side navigation redirect condition in React Router and Remix applications using Framework Mode, Data Mode, or unstable React Server Components modes. When a loader or action constructs a redirect target from untrusted input, or when an application exposes an open redirect path, affected router versions may allow unsafe URL schemes such as JavaScript URLs to be treated as navigation targets. If a victim interacts with a crafted link or flow, attacker-controlled JavaScript can execute in the browser in the context of the vulnerable application. Declarative Mode using <BrowserRouter> is not affected. Impact is primarily client-side script execution with potential confidentiality and integrity compromise of user sessions and application data accessible to the browser.

Why it matters to the business

Successful exploitation can allow an attacker to run code in a user’s browser as if it came from the trusted application, enabling session theft, account takeover workflows, fraudulent actions, phishing overlays, or tampering with data shown to users. The issue requires user interaction and specific application behavior, which lowers broad exploitation likelihood, and it is not currently listed in CISA KEV or known to be used in ransomware campaigns. However, the CVSS score is high because exploitation can cross trust boundaries and expose sensitive user data. Organizations using React Router or Remix in internet-facing applications should prioritize review and remediation, especially where redirect destinations are derived from query parameters, form fields, headers, or other user-controlled content.

How an attack unfolds

An attacker first identifies an application built with an affected React Router, Remix, or @remix-run/router version and determines whether it uses loaders or actions that issue redirects based on untrusted input. The attacker then crafts a URL, form submission, or navigation path that causes the application to generate a redirect containing an unsafe destination such as a JavaScript URL or an open redirect target that resolves to script execution. The victim must interact with the crafted link or workflow. In vulnerable configurations, the router processes the redirect as a client-side navigation and executes attacker-supplied JavaScript in the browser under the application’s origin. The attacker can then read or modify page content, access tokens or sensitive data available to client-side scripts, perform actions as the victim, or redirect the victim to credential-harvesting content.

How to fix it

Upgrade affected dependencies to patched versions: @remix-run/router 1.23.2 or later and react-router 7.12.0 or later. For source-based consumers of remix-run/react-router, ensure the code includes the fix at commit c662ca366a414bf42624dd6cd20a7c414b2602e3 or a later trusted release. Also upgrade Remix dependencies where they pull in affected router behavior. After upgrading, rebuild and redeploy client bundles so users receive patched JavaScript assets. As defense in depth, validate all redirect destinations server-side and client-side before passing them to redirect helpers; allow only relative application paths or explicitly allowlisted origins; reject javascript:, data:, vbscript:, file:, blob:, and protocol-relative URLs unless intentionally required and safely handled. Avoid constructing redirects directly from request parameters or form fields without canonicalization. Add Content Security Policy controls that restrict script execution, although CSP should not be treated as a substitute for upgrading. If immediate upgrade is not possible, remove or hard-code affected redirects, enforce strict allowlists, and block unsafe URL schemes at input validation boundaries.

How to confirm the fix worked

Confirm dependency versions in package manifests, lockfiles, software composition analysis output, and built artifacts. Ensure @remix-run/router is 1.23.2 or later and react-router is 7.12.0 or later; for source builds, verify inclusion of commit c662ca366a414bf42624dd6cd20a7c414b2602e3 or later. Search application code for loaders and actions that call redirect-like APIs using request-derived values. Test known redirect endpoints and navigation flows with encoded and unencoded unsafe schemes such as javascript:alert(1), data:text/html, and protocol-relative external URLs; the application should reject them or normalize them to safe internal paths without executing script. Verify that Declarative Mode-only applications are not relying on affected modes, but still retain redirect validation as a best practice. After deployment, clear caches or validate cache-busting so patched client bundles are served to users.

Typical attack path

1. Identify a React Router or Remix application using affected versions: @remix-run/router prior to 1.23.2 or react-router 7.0.0 through 7.11.0.
2. Find a loader or action that performs redirects using a destination influenced by user-controlled input, such as a next, returnTo, redirect, url, path, or callback parameter.
3. Craft a malicious request or link that supplies an unsafe redirect destination, commonly using a javascript: URL or encoded variant.
4. Deliver the crafted link or workflow to a target user through phishing, embedded links, chat, email, or a compromised referring site.
5. When the user interacts, trigger the vulnerable redirect path in Framework Mode, Data Mode, or unstable RSC mode.
6. Achieve JavaScript execution in the victim’s browser in the context of the trusted application.
7. Use the script execution to steal browser-accessible secrets, alter page behavior, initiate unauthorized user actions, or present phishing content.

How to detect it

Review web access logs, CDN logs, WAF logs, application logs, and browser/client telemetry for requests to redirect-capable routes containing unsafe URL schemes or encoded equivalents. Focus on parameters commonly used for navigation, including next, returnTo, redirect, url, path, callback, continue, target, destination, and from. Look for repeated probing with javascript:, data:, vbscript:, file:, blob:, protocol-relative URLs, excessive URL encoding, mixed-case schemes, or control characters before a scheme. Correlate suspicious requests with user-agent, referrer, source IP, session identifiers, authentication events, and subsequent account activity. In application logs, review loader/action redirect outputs and errors around rejected or malformed redirect destinations. In frontend monitoring or CSP report-only telemetry, look for script execution attempts, unexpected inline script violations, navigation to javascript: URLs, suspicious fetch/XHR calls following redirect flows, or sudden redirects to credential-harvesting domains. Because exploitation is client-side and requires user interaction, absence of server-side errors does not prove absence of exploitation; prioritize evidence from WAF/CDN request logs, CSP reports, RUM/browser telemetry, and user session anomaly logs.

• javascript:
• java%73cript:
• javas%63ript:
• %6a%61%76%61%73%63%72%69%70%74%3a
• %0djavascript:
• %0ajavascript:
• %09javascript:
• data:text/html
• data%3Atext%2Fhtml
• vbscript:
• file:
• blob:
• redirect=javascript:
• redirect=java%73cript:
• redirect=%6a%61%76%61%73%63%72%69%70%74%3a
• returnTo=javascript:
• returnTo=%6a%61%76%61%73%63%72%69%70%74%3a
• next=javascript:
• next=%6a%61%76%61%73%63%72%69%70%74%3a
• url=javascript:
• url=%6a%61%76%61%73%63%72%69%70%74%3a
• callback=javascript:
• continue=javascript:
• destination=javascript:
• target=javascript:
• path=javascript:
• redirect=data:text/html
• returnTo=data:text/html
• next=data:text/html
• url=data:text/html
• "@remix-run/router": "1.23.1"
• "@remix-run/router": "1.23.0"
• "react-router": "7.0.0"
• "react-router": "7.1.0"
• "react-router": "7.2.0"
• "react-router": "7.3.0"
• "react-router": "7.4.0"
• "react-router": "7.5.0"
• "react-router": "7.6.0"
• "react-router": "7.7.0"
• "react-router": "7.8.0"
• "react-router": "7.9.0"
• "react-router": "7.10.0"
• "react-router": "7.11.0"

What your security team should do

• Inventory all applications using React Router, Remix, or @remix-run/router and identify versions in package-lock.json, yarn.lock, pnpm-lock.yaml, npm-shrinkwrap.json, and SBOM/SCA tooling.
• Prioritize internet-facing and authentication-adjacent applications that use loaders or actions for redirects, especially login, logout, invitation, password reset, SSO callback, checkout, and deep-link flows.
• Upgrade to @remix-run/router 1.23.2 or later and react-router 7.12.0 or later, then rebuild and redeploy frontend bundles.
• Review all redirect construction logic and require an allowlist of relative paths or trusted origins; reject unsafe URL schemes after URL decoding and canonicalization.
• Add automated tests for redirect parameters using javascript:, encoded javascript:, data:, protocol-relative URLs, and external domains.
• Deploy or tune WAF and web telemetry rules to flag requests containing unsafe redirect payloads in common parameters such as redirect, returnTo, next, url, path, callback, continue, and destination.
• Hunt historical logs for attempts to pass javascript: or encoded script schemes into redirect-related parameters and investigate matching user sessions.
• Use CSP as defense in depth to limit script execution and data exfiltration, while recognizing that the primary fix is dependency upgrade and redirect validation.