Packages / react-router / Security

HighVulnerabilityGHSA-chx6-hx7r-mcp5CVE-2026-55685Published 24 Jul 2026

React Router: Unauthenticated Denial of Service via Inefficient Route Matching

Affected releases · react-router

  • 7.x7.0.0 – 7.17.0Fixed in 7.18.0

On 7.x, the newest line:

npm install react-router@7.18.0
8.x

  1. Not affected

    8.0.0 – 8.5.0

    8 releases, latest

7.x

  1. Affected

    7.0.0 – 7.17.0

    47 releases

  2. Fixed

    7.18.0 – 7.18.4

    5 releases

228 stable releases of react-router, oldest to newest, one row per major.

Is your project affected?

Paste your package.json, or type the range you declare for react-router. It is read in your browser and sent nowhere.

What happens

This is a follow up to github.com/remix-run/react-router/security/advi… that covers additional reported scenarios in which the manifest endpoint could be accessed via unauthenticated targeted requests that would put heavy load on the server and slow down response times.

[!NOTE] This only impacts Framework Mode applications. This does not impact your application if you are using Declarative or Data Mode.