Packages / react-router / Security

HighVulnerabilityGHSA-rxv8-25v2-qmq8CVE-2026-34077Published 4 Jun 2026

React Router vulnerable to Denial of Service via reflected user input in single-fetch

Affected releases · react-router

  • 7.x7.0.0 – 7.13.2Fixed in 7.14.0

On 7.x, the newest line:

npm install react-router@7.14.0
8.x

  1. Not affected

    8.0.0 – 8.5.0

    8 releases, latest

7.x

  1. Affected

    7.0.0 – 7.13.2

    40 releases

  2. Fixed

    7.14.0 – 7.18.4

    12 releases

228 stable releases of react-router, oldest to newest, one row per major.

Is your project affected?

Paste your package.json, or type the range you declare for react-router. It is read in your browser and sent nowhere.

What happens

A DoS vulnerability exists in the React Router v7 Framework Mode, as well as Remix v2.9.0+ with Single Fetch enabled. In some scenarios the underlying serialization algorithm can become a bottleneck when encoding specific types of data into server responses. Please upgrade to React Router v7.14.0 or later.

[!NOTE] This does not impact your React Router application if you are using Declarative Mode (<BrowserRouter>) or Data Mode (createBrowserRouter/<RouterProvider>).