react-router
8.5.0 · 19 Oct 2026MIT33.1M / weekRepositorynpmAtom feed
Security advisories
From OSV, open ones first. Each release line gets its own fix: an older major is fixed by a patch on that major, not by moving to the newest one.
Is your project affected?
Paste your package.json, or type the range you declare for react-router. It is read in your browser and sent nowhere.
| Line | Newest | Where it stands |
|---|---|---|
| 8.5.0 | Safe from 8.3.0 | |
| 7.18.4 | Safe from 7.18.2 | |
| 6.30.6 | 2 open advisories, worst moderate |
- HighReact Router: RSC Mode CSRF Bypass Allows Action Execution Before 400 ResponseGHSA-qwww-vcr4-c8h2 · 24 Jul 2026
- 8.x8.0.0 – 8.2.0Fixed in 8.3.0
- 7.x7.12.0 – 7.18.1Fixed in 7.18.2
- HighReact Router: Unauthenticated Denial of Service via Inefficient Route MatchingGHSA-chx6-hx7r-mcp5 · 24 Jul 2026
- 7.x7.0.0 – 7.17.0Fixed in 7.18.0
- HighReact Router vulnerable to Denial of Service via reflected user input in single-fetchGHSA-rxv8-25v2-qmq8 · 4 Jun 2026
- 7.x7.0.0 – 7.13.2Fixed in 7.14.0
- HighReact Router vulnerable to DoS via unbounded path expansion in __manifest endpointGHSA-8x6r-g9mw-2r78 · 3 Jun 2026
- 7.x7.0.0 – 7.14.2Fixed in 7.15.0
- High
- 7.x7.0.0 – 7.14.1Fixed in 7.14.2
- HighReact Router vulnerable to XSS in unstable RSC redirect handling via javascript: redirect targetsGHSA-8646-j5j9-6r62 · 3 Jun 2026
- 7.x7.7.0 – 7.13.1Fixed in 7.13.2
- HighReact Router vulnerable to XSS via Open RedirectsGHSA-2w69-qvjg-hvjx · 8 Jan 2026
- 7.x7.0.0 – 7.11.0Fixed in 7.12.0
- HighReact Router SSR XSS in ScrollRestorationGHSA-8v8x-cx79-35w7 · 8 Jan 2026
- 7.x7.0.0 – 7.11.0Fixed in 7.12.0
- HighReact Router has XSS VulnerabilityGHSA-3cgp-3xvw-98x8 · 8 Jan 2026
- 7.x7.0.0 – 7.8.2Fixed in 7.9.0
- HighReact Router allows pre-render data spoofing on React-Router framework modeGHSA-cpj6-fhp6-mr6j · 24 Apr 2025
- 7.x7.0.0 – 7.5.1Fixed in 7.5.2
- HighReact Router allows a DoS via cache poisoning by forcing SPA modeGHSA-f46r-rw29-r322 · 24 Apr 2025
- 7.x7.2.0 – 7.5.1Fixed in 7.5.2
- ModerateReact Router: Open redirect via backslash in <Link> and useNavigate (CVE-2025-68470 bypass)GHSA-wrjc-x8rr-h8h6 · 23 Jul 2026
- 7.x7.0.0 – 7.17.0Fixed in 7.18.0
- 6.x6.0.0 – 6.30.6No fix on 6.x · move to 7.18.0
- ModerateReact Router: Open redirect leading to XSSGHSA-jjmj-jmhj-qwj2 · 23 Jul 2026
- 7.x7.9.6 – 7.12.0Fixed in 7.13.0
- ModerateReact Router: RSCErrorHandler Missing Protocol Validation (XSS)GHSA-h8fp-f39c-q6mh · 23 Jul 2026
- 7.x7.11.0 – 7.17.0Fixed in 7.18.0
- ModerateReact Router: Arbitrary Constructor Injection via deserializeErrors() in React Router SSR HydrationGHSA-337j-9hxr-rhxg · 23 Jul 2026
- 7.x7.0.0 – 7.17.0Fixed in 7.18.0
- 6.x6.4.0 – 6.30.6No fix on 6.x · move to 7.18.0
- ModerateReact Router's same-origin redirect with path starting // causes open redirect via protocol-relative URL reinterpretationGHSA-2j2x-hqr9-3h42 · 3 Jun 2026
- 7.x7.0.0 – 7.14.0Fixed in 7.14.1
- 6.x6.7.0 – 6.30.3Fixed in 6.30.4
- ModerateReact Router has stored XSS via unescaped Location header in prerendered redirect HTMLGHSA-f22v-gfqf-p8f3 · 3 Jun 2026
- 7.x7.5.1 – 7.13.1Fixed in 7.13.2
- ModerateReact Router has CSRF issue in Action/Server Action Request ProcessingGHSA-h5cw-625j-3rxh · 8 Jan 2026
- 7.x7.0.0 – 7.11.0Fixed in 7.12.0
- ModerateReact Router has unexpected external redirect via untrusted pathsGHSA-9jcx-v3wj-wh4m · 8 Jan 2026
- 7.x7.0.0 – 7.9.5Fixed in 7.9.6
- 6.x6.0.0 – 6.30.1Fixed in 6.30.2
- LowReact Router: Potential CSRF via PUT/PATCH/DELETE document requestsGHSA-84g9-w2xq-vcv6 · 15 Jun 2026
- 7.x7.12.0 – 7.15.0Fixed in 7.15.1
Registry facts last checked 21 Oct 2026. Releases and advisories last read 21 Oct 2026.