Description
React Router is a router for React. In versions 7.0.0 through 7.17.0, the manifest endpoint could be accessed via unauthenticated targeted requests that would put heavy load on the server and slow down response times. This issue is a follow up to CVE-2026-42342, and does not does not impact React Router applications using Declarative Mode (<BrowserRouter>) or Data Mode (createBrowserRouter/<RouterProvider>). This issue has been fixed in version 7.18.0.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| remix-run | react-router | >= 7.0.0, < 7.18.0 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Wolfi
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Wolfi rolling | vitess-24 | 24.0.2-r7 | — |
| Wolfi rolling | vitess-24-compat | 24.0.3-r7 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| npm | react-router | >= 7.0.0, < 7.18.0 | 7.18.0 | GHSA-chx6-hx7r-mcp5 |
Advisories 2
- WID-SEC-2026-2923 Atlassian Produkte (Bamboo, Bitbucket, Confluence, Crucible, Fisheye, und Jira): Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 8, 2026
- NCSC-2026-0325 Kwetsbaarheden verholpen in Atlassian producten NCSC-NL (Netherlands) · Aug 24, 2026
References
- https://github.com/remix-run/react-router/security/advisories/GHSA-chx6-hx7r-mcp5
- https://github.com/remix-run/react-router/security/advisories/GHSA-8x6r-g9mw-2r78
- https://github.com/remix-run/react-router/pull/15186
- https://github.com/remix-run/react-router/commit/09e6020d1950e54f361f7ad00938ecd4dde60929
- https://github.com/remix-run/react-router/blob/main/CHANGELOG.md#v7180
- https://github.com/remix-run/react-router/releases/tag/react-router@7.18.0