Packages / react-router / Security

HighVulnerabilityGHSA-8v8x-cx79-35w7CVE-2026-21884Published 8 Jan 2026

React Router SSR XSS in ScrollRestoration

Affected releases · react-router

  • 7.x7.0.0 – 7.11.0Fixed in 7.12.0

On 7.x, the newest line:

npm install react-router@7.12.0
8.x

  1. Not affected

    8.0.0 – 8.5.0

    8 releases, latest

7.x

  1. Affected

    7.0.0 – 7.11.0

    36 releases

  2. Fixed

    7.12.0 – 7.18.4

    16 releases

228 stable releases of react-router, oldest to newest, one row per major.

Is your project affected?

Paste your package.json, or type the range you declare for react-router. It is read in your browser and sent nowhere.

What happens

A XSS vulnerability exists in in React Router's <ScrollRestoration> API in Framework Mode when using the getKey/storageKey props during Server-Side Rendering which could allow arbitrary JavaScript execution during SSR if untrusted content is used to generate the keys.

[!NOTE] This does not impact applications if developers have disabled server-side rendering in Framework Mode, or if they are using Declarative Mode (<BrowserRouter>) or Data Mode (createBrowserRouter/<RouterProvider>).