CVE-2026-34077

What it actually does

React Router versions 7.7.0 through 7.13.1 can mishandle redirects when applications use the unstable React Server Components (RSC) APIs and allow redirect destinations or redirect responses to be influenced by untrusted input. If an attacker can cause the RSC redirect handling path to process a malicious client-side redirect value, the browser may execute attacker-controlled script in the context of the affected application. Applications that do not use React Router's unstable RSC APIs are not affected by this specific issue.

Why it matters to the business

A successful attack can cause users' browsers to run unauthorized code inside a trusted web application, which may enable account takeover workflows, credential or token theft, malicious actions performed as the user, defacement, or disruption of user sessions. The risk is concentrated in applications using React Router 7.7.0 through 7.13.1 with unstable RSC APIs and untrusted redirects; broad ecosystem use of React Router means many organizations may need to verify exposure even if exploitation has not been publicly reported. This vulnerability is not currently listed in CISA KEV and has low EPSS at the time of assessment, but internet-facing applications should still prioritize remediation because XSS issues are often easy to weaponize once an affected code path is identified.

How an attack unfolds

An attacker first identifies a React application using an affected React Router version and the unstable RSC APIs. They then find an application flow where a redirect target, redirect response, or route transition can be influenced through a URL parameter, form field, API response, or other untrusted source. The attacker supplies a crafted redirect value designed to be interpreted by the client as executable script or unsafe markup rather than as a safe navigation target. When a victim's browser processes the RSC redirect, React Router's vulnerable redirect handling may allow the payload to execute in the application's origin. The attacker can then use that script execution to read accessible page data, interact with the application as the victim, steal non-HttpOnly tokens, redirect the user to phishing content, or cause client-side disruption. Exploitation depends on application-specific use of the unstable RSC APIs and whether untrusted redirect input reaches the vulnerable redirect handler.

How to fix it

Upgrade React Router to version 7.13.2 or later anywhere versions 7.7.0 through 7.13.1 are in use. If using package locks, regenerate and redeploy lockfiles so the runtime bundle actually contains the patched version. If an immediate upgrade is not possible, stop using the unstable RSC APIs where practical, and ensure all redirect destinations are derived only from trusted server-side constants or are strictly validated against an allowlist of relative paths and approved origins. Reject or normalize redirects containing unsafe URL schemes such as javascript: or data:, encoded control characters, HTML markup, or attacker-controlled absolute URLs. Avoid passing user-supplied values directly into redirect helpers. Add server-side validation for any redirect target accepted from request parameters, headers, form fields, or downstream service responses.

How to confirm the fix worked

Confirm dependency inventory and build artifacts no longer include react-router versions 7.7.0 through 7.13.1 in applications using RSC APIs. Run package-manager checks such as npm ls react-router, pnpm why react-router, yarn why react-router, and inspect lockfiles for affected versions. Verify deployed JavaScript bundles were rebuilt after the dependency update and are not still serving cached vulnerable assets. Review application code for use of unstable RSC APIs and redirect helpers that consume user-controlled data. Test redirect-related routes with benign unsafe inputs such as javascript:alert(1), data:text/html,<script>alert(1)</script>, protocol-relative URLs, encoded variants, and external absolute URLs, and confirm they are rejected, safely encoded, or converted to approved relative paths without script execution. Use browser developer tools and automated DAST checks to verify no script execution occurs during RSC redirect handling.

Typical attack path

1. Identify a public React application using React Router versions 7.7.0 through 7.13.1.
2. Determine whether the application uses React Router unstable React Server Components APIs.
3. Find a route, action, loader, form submission, API response, or URL parameter that can influence a redirect destination.
4. Submit a crafted redirect payload using an unsafe scheme, encoded script-like value, or attacker-controlled redirect target.
5. Cause a victim browser to process the vulnerable RSC redirect path, either through a link, embedded content, or normal application workflow.
6. Execute attacker-controlled JavaScript in the trusted application origin if the vulnerable redirect handling is reached.
7. Use the browser execution context to steal accessible data, perform actions as the user, redirect to phishing content, or disrupt the user session.

How to detect it

To determine whether exploitation already occurred, review web server, CDN, WAF, application, and RSC endpoint logs for requests containing suspicious redirect-related parameters or payloads using script-capable schemes, encoded JavaScript, HTML tags, or external attacker-controlled destinations. Focus on routes that perform redirects after login, logout, form submission, navigation actions, error handling, or RSC route transitions. Inspect frontend error telemetry, CSP violation reports, browser monitoring, and session replay metadata for unexpected script execution, blocked inline script, navigation to unusual schemes, or sudden redirects to unfamiliar domains. If CSP reporting is enabled, look for violations involving script-src, navigate-to, form-action, or frame-src around affected routes. Correlate suspicious requests with user session anomalies such as unexpected account actions, rapid navigation changes, new device/session creation, token refresh anomalies, or reports of phishing-like redirects. Because no widely reported public exploit indicators are provided for this CVE, detection should be behavior- and payload-focused rather than based on a single known signature.

• javascript:
• java%73cript:
• %6a%61%76%61%73%63%72%69%70%74%3a
• data:text/html
• data%3Atext%2Fhtml
• <script
• %3Cscript
• onerror=
• onload=
• alert(
• document.cookie
• window.location
• location.href
• redirect=javascript:
• redirect_uri=javascript:
• returnUrl=javascript:
• next=javascript:
• url=javascript:

What your security team should do

• Inventory all applications and repositories using React Router and identify any running versions 7.7.0 through 7.13.1.
• Prioritize internet-facing applications and any application using unstable React Server Components APIs.
• Upgrade React Router to 7.13.2 or later and redeploy rebuilt frontend/server bundles.
• Search code for redirect handling that accepts user-controlled input from query parameters, form data, request headers, API responses, or downstream service responses.
• Implement redirect allowlists and reject unsafe schemes including javascript: and data:.
• Review web access logs, application logs, and frontend telemetry for suspicious redirect parameters or encoded script payloads targeting affected routes.
• Invalidate cached assets or CDN content that may still serve vulnerable bundles after patching.
• Add regression tests for unsafe redirect values to prevent reintroduction of client-side redirect XSS.
• Because this is not currently KEV-listed and exploit maturity is reported as none, treat remediation as high priority for exposed RSC applications rather than an emergency across applications that do not use the affected APIs.