react-router vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Browse by ecosystem

npm PyPI Maven Go RubyGems Cargo NuGet Composer pub Swift GitHub Actions

CVE-IDSeverityPackage summary

CVE-2026-53663Lowreact-router: React Router: Potential CSRF via PUT/PATCH/DELETE document requests CVE-2026-34077Highreact-router: React Router vulnerable to Denial of Service via reflected user input in single-fetch CVE-2026-42342Highreact-router: React Router vulnerable to DoS via unbounded path expansion in __manifest endpoint CVE-2026-42211Highreact-router: React Router's vendored turbo-stream v2 allows arbitrary constructor invocation via TYPE_ERROR…CVE-2026-40181Mediumreact-router: React Router's same-origin redirect with path starting // causes open redirect via…CVE-2026-33245Highreact-router: React Router vulnerable to XSS in unstable RSC redirect handling via javascript: redirect targets CVE-2026-33244Mediumreact-router: React Router has stored XSS via unescaped Location header in prerendered redirect HTML CVE-2026-22030Mediumreact-router: React Router has CSRF issue in Action/Server Action Request Processing CVE-2026-22029Highreact-router: React Router vulnerable to XSS via Open Redirects CVE-2026-21884Highreact-router: React Router SSR XSS in ScrollRestoration CVE-2025-68470Mediumreact-router: React Router has unexpected external redirect via untrusted paths CVE-2025-59057Highreact-router: React Router has XSS Vulnerability CVE-2025-43865Highreact-router: React Router allows pre-render data spoofing on React-Router framework mode CVE-2025-43864Highreact-router: React Router allows a DoS via cache poisoning by forcing SPA mode

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo

Get a personalized demo