GHSA-8x6r-g9mw-2r78
High · 7.5CVSS
7.5
EPSS
—
Published
Jun 3, 2026
CISA due date
—
The record
React Router vulnerable to DoS via unbounded path expansion in __manifest endpoint
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| npm | @remix-run/server-runtime | 2.10.0 | 2.17.5 |
| npm | react-router | 7.0.0 | 7.15.0 |
Related vulnerabilities
- CVE-2026-42342 React Router is a router for React. Same vulnerability
- CVE-2026-53663 React Router is a router for React. Also affects @remix-run/server-runtime
- GHSA-84g9-w2xq-vcv6 React Router: Potential CSRF via PUT/PATCH/DELETE document requests Also affects @remix-run/server-runtime
- CVE-2026-22030 React Router is a router for React. Also affects @remix-run/server-runtime
- GHSA-h5cw-625j-3rxh React Router has CSRF issue in Action/Server Action Request Processing Also affects @remix-run/server-runtime
- GHSA-rxv8-25v2-qmq8 React Router vulnerable to Denial of Service via reflected user input in single-fetch Also affects react-router
- GHSA-49rj-9fvp-4h2h React Router's vendored turbo-stream v2 allows arbitrary constructor invocation via… Also affects react-router
- GHSA-2j2x-hqr9-3h42 React Router's same-origin redirect with path starting // causes open redirect via… Also affects react-router