CVE-2026-42342

What it actually does

CVE-2026-42342 is an unauthenticated network-exploitable denial-of-service flaw in React Router Framework Mode and Remix server-runtime request handling. A crafted request to the `__manifest` endpoint can trigger unbounded path expansion, causing the server to spend disproportionate CPU and/or memory resources building a response. Successful exploitation does not provide code execution or data access, but it can significantly increase response latency, exhaust application worker capacity, and make the application unavailable. The issue affects `react-router` versions 7.0.0 through 7.14.x and `@remix-run/server-runtime` versions 2.10.0 through 2.17.4. Applications using only Declarative Mode with `<BrowserRouter>` or Data Mode with `createBrowserRouter` / `<RouterProvider>` are not affected by this specific flaw.

Why it matters to the business

Public-facing web applications built with affected React Router Framework Mode or Remix versions may be slowed down or taken offline by relatively simple unauthenticated HTTP traffic. The practical business impact is service disruption: failed user sessions, degraded checkout or account workflows, increased infrastructure costs from autoscaling, and operational load on support and incident response teams. The CVSS availability impact is high, but current EPSS is low and there is no known CISA KEV listing or reported ransomware use, so urgency should be highest for internet-facing, revenue-critical, or high-traffic applications using the affected packages.

How an attack unfolds

An attacker identifies a React Router Framework Mode or Remix application exposed over HTTP/S and probes for the `__manifest` endpoint. They then send specially crafted requests that cause the server-side routing manifest logic to perform excessive or unbounded path expansion. Because exploitation requires no authentication, no user interaction, and low attack complexity, the attacker can repeat or parallelize the requests from one or more clients to consume application worker threads, CPU, memory, or event-loop capacity. As resource consumption increases, legitimate users experience slower responses, timeouts, elevated error rates, or full service unavailability. There is no indication from the supplied data that exploitation yields data theft, privilege escalation, or arbitrary code execution.

How to fix it

Upgrade affected dependencies to patched versions: `react-router` version 7.15.0 or later and `@remix-run/server-runtime` version 2.17.5 or later. Rebuild and redeploy applications after updating lockfiles to ensure the patched package versions are actually present in production artifacts. If immediate upgrade is not possible, apply layered mitigations: rate-limit requests to `__manifest`, enforce request URI length limits, block obviously abnormal path expansion patterns at a CDN/WAF/reverse proxy, set conservative upstream timeout and concurrency limits, and ensure autoscaling and circuit breakers do not amplify cost during attack traffic. Applications using only `<BrowserRouter>` Declarative Mode or `createBrowserRouter` / `<RouterProvider>` Data Mode should still verify dependency exposure, but are not affected by this specific vulnerable server-side path.

How to confirm the fix worked

Confirm package versions in the deployed artifact, not only in source control. Inspect `package-lock.json`, `yarn.lock`, `pnpm-lock.yaml`, SBOMs, container images, and runtime package metadata for `react-router` versions 7.0.0 through 7.14.x or `@remix-run/server-runtime` versions 2.10.0 through 2.17.4. Validate that production deployments contain `react-router >= 7.15.0` and/or `@remix-run/server-runtime >= 2.17.5` where those packages are used. Check whether the application is using React Router Framework Mode or Remix; applications exclusively using Declarative Mode or Data Mode are not affected by this flaw. After remediation, perform controlled testing against `__manifest` with normal and malformed path inputs in a non-production environment and confirm stable latency, CPU, memory, event-loop delay, and error rates. In production, verify that rate limits, URI length restrictions, and WAF/CDN rules are active and logging matches expected behavior.

Typical attack path

1. Discover a public web application built with affected React Router Framework Mode or Remix server-runtime versions.
2. Confirm that the application exposes or responds to requests involving the `__manifest` endpoint.
3. Send crafted `__manifest` requests designed to trigger excessive path expansion on the server.
4. Increase request rate, concurrency, or distribution across source addresses to amplify resource exhaustion.
5. Monitor for slow responses, HTTP 5xx errors, connection timeouts, or degraded availability as confirmation of impact.
6. Sustain or repeat the traffic to keep the application degraded or unavailable.

How to detect it

To determine whether exploitation already occurred, review HTTP access logs from CDN, WAF, load balancers, reverse proxies, and application servers for abnormal traffic to `__manifest`. Focus on sudden increases in request volume, long or deeply nested URLs, encoded path traversal-like sequences, high request concurrency from a small set of IPs, and traffic bursts correlated with elevated CPU, memory, event-loop delay, upstream timeouts, HTTP 499/500/502/503/504 responses, pod or process restarts, or autoscaling events. Application logs may not show a unique stack trace, so correlate endpoint-level latency and resource metrics with request metadata. Search observability platforms for p95/p99 latency spikes on `__manifest`, increased Node.js event-loop lag, out-of-memory events, worker restarts, and reverse proxy timeout messages. Because no specific public exploit payload or threat actor is identified in the supplied data, detection should be behavior-based rather than signature-only.

• /__manifest
• __manifest
• GET /__manifest
• POST /__manifest
• %2F__manifest
• /__manifest/
• upstream timed out
• upstream prematurely closed connection
• HTTP 503
• HTTP 504
• Error: socket hang up
• JavaScript heap out of memory
• FATAL ERROR: Reached heap limit Allocation failed
• ENOMEM
• ETIMEDOUT
• ECONNRESET
• event loop lag
• react-router@7.0.0
• react-router@7.1.0
• react-router@7.2.0
• react-router@7.3.0
• react-router@7.4.0
• react-router@7.5.0
• react-router@7.6.0
• react-router@7.7.0
• react-router@7.8.0
• react-router@7.9.0
• react-router@7.10.0
• react-router@7.11.0
• react-router@7.12.0
• react-router@7.13.0
• react-router@7.14.
• @remix-run/server-runtime@2.10.
• @remix-run/server-runtime@2.11.
• @remix-run/server-runtime@2.12.
• @remix-run/server-runtime@2.13.
• @remix-run/server-runtime@2.14.
• @remix-run/server-runtime@2.15.
• @remix-run/server-runtime@2.16.
• @remix-run/server-runtime@2.17.0
• @remix-run/server-runtime@2.17.1
• @remix-run/server-runtime@2.17.2
• @remix-run/server-runtime@2.17.3
• @remix-run/server-runtime@2.17.4

What your security team should do

• Inventory internet-facing React Router Framework Mode and Remix applications and identify any use of `react-router` 7.0.0 through 7.14.x or `@remix-run/server-runtime` 2.10.0 through 2.17.4.
• Prioritize upgrades for externally reachable, revenue-critical, authentication-front-door, or high-traffic applications, even though the vulnerability is not currently listed in CISA KEV and has low EPSS.
• Upgrade to `react-router` 7.15.0 or later and `@remix-run/server-runtime` 2.17.5 or later, then rebuild and redeploy from clean dependency lockfiles.
• Add temporary edge protections for `__manifest`, including rate limiting, request URI length limits, abnormal path-pattern blocking, and alerting on spikes in requests or latency.
• Create monitoring dashboards for `__manifest` request volume, response time, 4xx/5xx rates, upstream timeouts, CPU, memory, event-loop lag, and container restarts.
• Review recent web, CDN, WAF, reverse proxy, and application logs for unusual `__manifest` traffic since publication, especially bursts from single IPs, repeated malformed paths, or requests correlated with latency and 5xx spikes.
• Ensure dependency scanning and SBOM generation flag vulnerable package ranges in CI/CD and deployed container images.