Skip to content
OpenAdvisories

Package · npm

@remix-run/router

2 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Feed

  • Medium 6.6
    CVE-2026-40181

    React Router's same-origin redirect with path starting // causes open redirect via protocol-relative URL reinterpretation

    React Router is a router for React. In versions 7.0.0 through 7.14.0 and 6.7.0 through 6.30.3, certain URLs passed to the redirect function can trigger an open redirect to an external domain due to path values starting with // being reinterpreted as protocol-…

    remix-run react-router @remix-run/router keycloak-26.5 Wolfi npm
  • High 8.0
    CVE-2026-22029

    React Router vulnerable to XSS via Open Redirects

    React Router is a router for React. In @remix-run/router version prior to 1.23.2 and react-router 7.0.0 through 7.11.0, React Router (and Remix v1/v2) SPA open navigation redirects originating from loaders or actions in Framework Mode, Data Mode, or the unsta…

    remix-run react-router @remix-run/router react-router npm