Packages / react-router / Security

ModerateVulnerabilityGHSA-jjmj-jmhj-qwj2CVE-2026-53668Published 23 Jul 2026

React Router: Open redirect leading to XSS

Affected releases · react-router

  • 7.x7.9.6 – 7.12.0Fixed in 7.13.0

On 7.x, the newest line:

npm install react-router@7.13.0
8.x

  1. Not affected

    8.0.0 – 8.5.0

    8 releases, latest

7.x

  1. Not affected

    7.0.0 – 7.9.5

    32 releases

  2. Affected

    7.9.6 – 7.12.0

    5 releases

  3. Fixed

    7.13.0 – 7.18.4

    15 releases

228 stable releases of react-router, oldest to newest, one row per major.

Is your project affected?

Paste your package.json, or type the range you declare for react-router. It is read in your browser and sent nowhere.

What happens

Applications with open redirects could permit attacker crafted links to result in redirects to unexpected external location or XSS vectors.