Packages / react-router / Security

HighVulnerabilityGHSA-49rj-9fvp-4h2hCVE-2026-42211Published 3 Jun 2026

React Router's vendored turbo-stream v2 allows arbitrary constructor invocation via TYPE_ERROR deserialization leading to Unauth RCE

Affected releases · react-router

  • 7.x7.0.0 – 7.14.1Fixed in 7.14.2

On 7.x, the newest line:

npm install react-router@7.14.2
8.x

  1. Not affected

    8.0.0 – 8.5.0

    8 releases, latest

7.x

  1. Affected

    7.0.0 – 7.14.1

    42 releases

  2. Fixed

    7.14.2 – 7.18.4

    10 releases

228 stable releases of react-router, oldest to newest, one row per major.

Is your project affected?

Paste your package.json, or type the range you declare for react-router. It is read in your browser and sent nowhere.

What happens

When using React Router v7 in Framework Mode, there exists a combination of steps that could potentially allow unauthorized RCE through external requests. This first requires the application code to have an existing prototype pollution vulnerability. This can be leveraged into a 2-step attack in which the second step can trigger unauthorized RCE on the remote server.

[!NOTE] This does not impact your React Router application if you are using Declarative Mode (<BrowserRouter>) or Data Mode (createBrowserRouter/<RouterProvider>).