Packages / react-router / Security

ModerateVulnerabilityGHSA-f22v-gfqf-p8f3CVE-2026-33244Published 3 Jun 2026

React Router has stored XSS via unescaped Location header in prerendered redirect HTML

Affected releases · react-router

  • 7.x7.5.1 – 7.13.1Fixed in 7.13.2

On 7.x, the newest line:

npm install react-router@7.13.2
8.x

  1. Not affected

    8.0.0 – 8.5.0

    8 releases, latest

7.x

  1. Not affected

    7.0.0 – 7.5.0

    14 releases

  2. Affected

    7.5.1 – 7.13.1

    25 releases

  3. Fixed

    7.13.2 – 7.18.4

    13 releases

228 stable releases of react-router, oldest to newest, one row per major.

Is your project affected?

Paste your package.json, or type the range you declare for react-router. It is read in your browser and sent nowhere.

What happens

When using React Router v7 Framework Mode with Pre-rendering enabled, an improper neutralization of the HTTP Location header value can permit Cross-Site Scripting (XSS) in statically generated HTML files if the redirect location comes from an untrusted source.

[!NOTE] This does not impact your React Router application if you are using Declarative Mode (<BrowserRouter>) or Data Mode (createBrowserRouter/<RouterProvider>).