Search for packages
| purl | pkg:npm/react-router@7.8.1-pre.1 |
| Vulnerability | Summary | Fixed by |
|---|---|---|
|
VCID-1khb-1639-afhf
Aliases: CVE-2026-21884 GHSA-8v8x-cx79-35w7 |
React Router SSR XSS in ScrollRestoration A XSS vulnerability exists in in React Router's `<ScrollRestoration>` API in [Framework Mode](https://reactrouter.com/start/modes#framework) when using the `getKey`/`storageKey` props during Server-Side Rendering which could allow arbitrary JavaScript execution during SSR if untrusted content is used to generate the keys. > [!NOTE] > This does not impact applications if developers have [disabled server-side rendering](https://reactrouter.com/how-to/spa) in Framework Mode, or if they are using [Declarative Mode](https://reactrouter.com/start/modes#declarative) (`<BrowserRouter>`) or [Data Mode](https://reactrouter.com/start/modes#data) (`createBrowserRouter`/`<RouterProvider>`). |
Affected by 0 other vulnerabilities. |
|
VCID-2bdv-sysu-ryef
Aliases: CVE-2025-68470 GHSA-9jcx-v3wj-wh4m |
React Router has unexpected external redirect via untrusted paths An attacker-supplied path can be crafted so that when a React Router application navigates to it via `navigate()`, `<Link>`, or `redirect()`, the app performs a navigation/redirect to an external URL. This is only an issue if developers pass untrusted content into navigation paths in their application code. |
Affected by 3 other vulnerabilities. |
|
VCID-7nah-t7y2-zfcy
Aliases: CVE-2025-59057 GHSA-3cgp-3xvw-98x8 |
React Router has XSS Vulnerability A XSS vulnerability exists in in React Router's `meta()`/`<Meta>` APIs in [Framework Mode](https://reactrouter.com/start/modes#framework) when generating `script:ld+json` tags which could allow arbitrary JavaScript execution during SSR if untrusted content is used to generate the tag. > [!NOTE] > This does not impact applications using [Declarative Mode](https://reactrouter.com/start/modes#declarative) (`<BrowserRouter>`) or [Data Mode](https://reactrouter.com/start/modes#data) (`createBrowserRouter`/`<RouterProvider>`). |
Affected by 4 other vulnerabilities. |
|
VCID-hwnh-8gqs-8fgj
Aliases: CVE-2026-22030 GHSA-h5cw-625j-3rxh |
React Router has CSRF issue in Action/Server Action Request Processing React Router (or Remix v2) is vulnerable to CSRF attacks on document POST requests to UI routes when using server-side route `action` handlers in [Framework Mode](https://reactrouter.com/start/modes#framework), or when using React Server Actions in the new unstable RSC modes. > [!NOTE] > This does not impact applications that use [Declarative Mode](https://reactrouter.com/start/modes#declarative) (`<BrowserRouter>`) or [Data Mode](https://reactrouter.com/start/modes#data) (`createBrowserRouter`/`<RouterProvider>`). |
Affected by 0 other vulnerabilities. |
|
VCID-y2ce-z8tu-y7e5
Aliases: CVE-2026-22029 GHSA-2w69-qvjg-hvjx |
React Router vulnerable to XSS via Open Redirects React Router (and Remix v1/v2) SPA open navigation redirects originating from loaders or actions in [Framework Mode](https://reactrouter.com/start/modes#framework), [Data Mode](https://reactrouter.com/start/modes#data), or the unstable RSC modes can result in unsafe URLs causing unintended javascript execution on the client. This is only an issue if developers are creating redirect paths from untrusted content or via an open redirect. > [!NOTE] > This does not impact applications that use [Declarative Mode](https://reactrouter.com/start/modes#declarative) (`<BrowserRouter>`). |
Affected by 0 other vulnerabilities. |
| Vulnerability | Summary | Aliases |
|---|---|---|
| This package is not known to fix vulnerabilities. | ||