Description
React Router is a router for React. In versions 7.0.0 through 7.14.0 and 6.7.0 through 6.30.3, certain URLs passed to the redirect function can trigger an open redirect to an external domain due to path values starting with // being reinterpreted as protocol-relative URLs. The level of impact depends on the validation done by the application prior to returning the redirect. This does not impact applications using Declarative Mode (<BrowserRouter>). This is patched in versions 7.14.1 and 6.30.4.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| remix-run | react-router | >= 7.0.0, < 7.14.1, >= 6.7.0, < 6.30.4 | — |
| remix-run | @remix-run/router | >= 1.3.0, < 1.23.3 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 15 SP7 | golang-github-prometheus-prometheus | 3.13.2-150100.4.40.2 | SUSE-SU-2026:4606-1 |
Show 2 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SUSE Multi Linux Manager Tools SLE-Micro-5 | uyuni-tools | 5.2.17-150002.3.20.1 | SUSE-SU-2026:4585-1 |
| SUSE Multi Linux Manager Tools SLE-Micro-5 | venv-salt-minion | 3006.0-150002.5.22.1 | SUSE-SU-2026:4585-1 |
| SUSE Multi Linux Manager Tools SLE-15 | golang-github-prometheus-prometheus | 3.13.2-150002.3.19.1 | SUSE-SU-2026:4585-1 |
| SUSE Multi Linux Manager Tools SLE-15 | grafana | 12.4.10-150002.4.27.1 | SUSE-SU-2026:4585-1 |
| SUSE Multi Linux Manager Tools SLE-15 | mgr-push | 5.2.5-150002.3.12.1 | SUSE-SU-2026:4585-1 |
| SUSE Multi Linux Manager Tools SLE-15 | spacecmd | 5.2.10-150002.3.15.1 | SUSE-SU-2026:4585-1 |
| SUSE Multi Linux Manager Tools SLE-15 | spacewalk-client-tools | 5.2.7-150002.3.12.1 | SUSE-SU-2026:4585-1 |
| SUSE Multi Linux Manager Tools SLE-15 | uyuni-tools | 5.2.17-150002.3.20.1 | SUSE-SU-2026:4585-1 |
| SUSE Multi Linux Manager Tools SLE-15 | venv-salt-minion | 3006.0-150002.5.22.1 | SUSE-SU-2026:4585-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Leap 16.0 | agama-web-ui | 17+673.b97ba64d6-160000.12.1 | openSUSE-SU-2026:21448-1 |
Wolfi
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Wolfi rolling | keycloak-26.5 +1 | 26.5.7-r3 | — |
| Wolfi rolling | keycloak-26.6 +1 | 26.6.4-r14 | — |
| Wolfi rolling | vitess-24 | 24.0.1-r2 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| npm | @remix-run/router | >= 1.3.0, < 1.23.3 | 1.23.3 | GHSA-2j2x-hqr9-3h42 |
| npm | react-router | >= 7.0.0, < 7.14.1 | 7.14.1 | GHSA-2j2x-hqr9-3h42 |
| npm | react-router | >= 6.7.0, < 6.30.4 | 6.30.4 | GHSA-2j2x-hqr9-3h42 |
Advisories 4
- WID-SEC-2026-3046 IBM Concert: Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 10, 2026
- SUSE-SU-2026:4606-1 Security update for golang-github-prometheus-prometheus SUSE / openSUSE Security Updates · Oct 10, 2026
- SUSE-SU-2026:4585-1 Security update 5.2.1 for Multi-Linux Manager Client Tools SUSE / openSUSE Security Updates · Oct 8, 2026
- openSUSE-SU-2026:21448-1 Security update for agama-web-ui SUSE / openSUSE Security Updates · Jul 29, 2026