Packages / react-router / Security

ModerateVulnerabilityGHSA-9jcx-v3wj-wh4mCVE-2025-68470Published 8 Jan 2026

React Router has unexpected external redirect via untrusted paths

Affected releases · react-router

  • 7.x7.0.0 – 7.9.5Fixed in 7.9.6
  • 6.x6.0.0 – 6.30.1Fixed in 6.30.2

On 7.x, the newest line:

npm install react-router@7.9.6
8.x

  1. Not affected

    8.0.0 – 8.5.0

    8 releases, latest

7.x

  1. Affected

    7.0.0 – 7.9.5

    32 releases

  2. Fixed

    7.9.6 – 7.18.4

    20 releases

6.x

  1. Affected

    6.0.0 – 6.30.1

    65 releases

  2. Fixed

    6.30.2 – 6.30.6

    5 releases

228 stable releases of react-router, oldest to newest, one row per major.

Is your project affected?

Paste your package.json, or type the range you declare for react-router. It is read in your browser and sent nowhere.

What happens

An attacker-supplied path can be crafted so that when a React Router application navigates to it via navigate(), <Link>, or redirect(), the app performs a navigation/redirect to an external URL. This is only an issue if developers pass untrusted content into navigation paths in their application code.