CVE-2026-22029
React Router vulnerable to XSS via Open Redirects
8.0 HighFix available
React Router is a router for React. In @remix-run/router version prior to 1.23.2 and react-router 7.0.0 through 7.11.0, React Router (and Remix v1/v2) SPA open navigation redirects originating from loaders or actions in Framework Mode, Data Mode, or the unstable RSC modes can result in unsafe URLs causing unintended javascript execution on the client. This is only an issue if you are creating redirect paths from untrusted content or via an open redirect. There is no impact if Declarative Mode (<BrowserRouter>) is being used. This issue has been patched in @remix-run/router version 1.23.2 and react-router version 7.12.0.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- None
Exploit likelihood
0.87%Up 0.8 points since Jan 10, 2026
What each source reports
CVE List Score used
React Router vulnerable to XSS via Open Redirects
React Router is a router for React. In @remix-run/router version prior to 1.23.2 and react-router 7.0.0 through 7.11.0, React Router (and Remix v1/v2) SPA open navigation redirects originating from loaders or actions in Framework Mode, Data Mode, or the unstable RSC modes can result in unsafe URLs causing unintended javascript execution on the client. This is only an issue if you are creating redirect paths from untrusted content or via an open redirect. There is no impact if Declarative Mode (<BrowserRouter>) is being used. This issue has been patched in @remix-run/router version 1.23.2 and react-router version 7.12.0.
- Record
CVE-2026-22029- CVSS 3.1
- 8.0 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:N - Weakness
- CWE-79, CWE-79
- Updated
- 2026-11-02
EUVDEUVD-2026-1465
React Router is a router for React. In @remix-run/router version prior to 1.23.2 and react-router 7.0.0 through 7.11.0, React Router (and Remix v1/v2) SPA open navigation redirects originating from loaders or actions in Framework Mode, Data Mode, or the unstable RSC modes can result in unsafe URLs causing unintended javascript execution on the client. This is only an issue if you are creating redirect paths from untrusted content or via an open redirect. There is no impact if Declarative Mode (<BrowserRouter>) is being used. This issue has been patched in @remix-run/router version 1.23.2 and react-router version 7.12.0.
- Record
EUVD-2026-1465- CVSS 3.1
- 8.0 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:N - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-2w69-qvjg-hvjx
React Router vulnerable to XSS via Open Redirects
React Router (and Remix v1/v2) SPA open navigation redirects originating from loaders or actions in Framework Mode, Data Mode, or the unstable RSC modes can result in unsafe URLs causing unintended javascript execution on the client. This is only an issue if developers are creating redirect paths from untrusted content or via an open redirect.
[!NOTE] This does not impact applications that use Declarative Mode (
<BrowserRouter>).
- Record
GHSA-2w69-qvjg-hvjx- CVSS 3.1
- 8.0 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
NVD
React Router is a router for React. In @remix-run/router version prior to 1.23.2 and react-router 7.0.0 through 7.11.0, React Router (and Remix v1/v2) SPA open navigation redirects originating from loaders or actions in Framework Mode, Data Mode, or the unstable RSC modes can result in unsafe URLs causing unintended javascript execution on the client. This is only an issue if you are creating redirect paths from untrusted content or via an open redirect. There is no impact if Declarative Mode (<BrowserRouter>) is being used. This issue has been patched in @remix-run/router version 1.23.2 and react-router version 7.12.0.
- Record
CVE-2026-22029- CVSS 3.1
- 8.0 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:N - CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
OSV
React Router vulnerable to XSS via Open Redirects
React Router is a router for React. In @remix-run/router version prior to 1.23.2 and react-router 7.0.0 through 7.11.0, React Router (and Remix v1/v2) SPA open navigation redirects originating from loaders or actions in Framework Mode, Data Mode, or the unstable RSC modes can result in unsafe URLs causing unintended javascript execution on the client. This is only an issue if you are creating redirect paths from untrusted content or via an open redirect. There is no impact if Declarative Mode (<BrowserRouter>) is being used. This issue has been patched in @remix-run/router version 1.23.2 and react-router version 7.12.0.
- Record
CVE-2026-22029- CVSS 3.1
- 8.0 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
OSVGHSA-2w69-qvjg-hvjx
React Router vulnerable to XSS via Open Redirects
React Router (and Remix v1/v2) SPA open navigation redirects originating from loaders or actions in Framework Mode, Data Mode, or the unstable RSC modes can result in unsafe URLs causing unintended javascript execution on the client. This is only an issue if developers are creating redirect paths from untrusted content or via an open redirect.
[!NOTE] This does not impact applications that use Declarative Mode (
<BrowserRouter>).
- Record
GHSA-2w69-qvjg-hvjx- CVSS 3.1
- 8.0 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
Show 7 moreShow less
OSVRHSA-2026:3958
Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.6 Product Security and Bug Fix Update
- Record
RHSA-2026:3958- CVSS 3.1
- 8.5 High
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H - Updated
- 2026-11-02
OSVRHSA-2026:3959
Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.5 Product Security and Bug Fix Update
- Record
RHSA-2026:3959- CVSS 3.1
- 8.5 High
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H - Updated
- 2026-11-02
OSVCLSA-2026-1775608279 No score
TuxCare security update for @remix-run/router (1 CVE)
TuxCare rebuilt @remix-run/router to address 1 CVE. Fixed in 1.23.0-tuxcare.1.
- Record
CLSA-2026-1775608279- Updated
- 2026-11-02
OSVCLSA-2026-1781052757 No score
TuxCare security update for @remix-run/router (1 CVE)
TuxCare rebuilt @remix-run/router to address 1 CVE. Fixed in 1.15.3-tuxcare.1.
- Record
CLSA-2026-1781052757- Updated
- 2026-11-02
OSVCLSA-2026-1781052758 No score
TuxCare security update for @remix-run/router (1 CVE)
TuxCare rebuilt @remix-run/router to address 1 CVE. Fixed in 1.6.2-tuxcare.1.
- Record
CLSA-2026-1781052758- Updated
- 2026-11-02
OSVopenSUSE-SU-2026:10069-1 No score
heroic-games-launcher-2.18.1-2.1 on GA media
These are all security issues fixed in the heroic-games-launcher-2.18.1-2.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2026:10069-1- Updated
- 2026-11-02
OSVROOT-APP-NPM-CVE-2026-22029 No score
CVE-2026-22029 in @remix-run/router - Patched by Root
Root has patched CVE-2026-22029 in the @remix-run/router package for Root:npm. Multiple fixed versions available.
- Record
ROOT-APP-NPM-CVE-2026-22029- Updated
- 2026-11-02
Affected products
- @tanstack react-router
- remix-run @remix-run/router
- remix-run react-router
- shopify react-router
- shopify remix-run\/react
- red hat cryostat 4
- red hat gatekeeper 3
- red hat logging subsystem for red hat openshift
- red hat migration toolkit for applications 7
- red hat migration toolkit for applications 8
- red hat migration toolkit for virtualization
- red hat multicluster engine for kubernetes
Show 67 moreShow less
- red hat multicluster engine for kubernetes 2.1
- red hat multicluster engine for kubernetes 2.6
- red hat multicluster engine for kubernetes 2.7
- red hat multicluster engine for kubernetes 2.8
- red hat network observability operator
- red hat node healthcheck operator
- red hat openshift lightspeed
- red hat openshift pipelines
- red hat openshift service mesh 2
- red hat openshift service mesh 3
- red hat advanced cluster management for kubernetes 2
- red hat advanced cluster management for kubernetes 2.11
- red hat advanced cluster management for kubernetes 2.12
- red hat advanced cluster management for kubernetes 2.13
- red hat advanced cluster management for kubernetes 2.14
- red hat advanced cluster management for kubernetes 2.15
- red hat advanced cluster security 4
- red hat advanced cluster security 4.8
- red hat advanced cluster security 4.9
- red hat ansible automation platform 2
- red hat ansible automation platform 2.5 for rhel 8
- red hat ansible automation platform 2.5 for rhel 9
- red hat ansible automation platform 2.6
- red hat ansible automation platform 2.6 for rhel 9
- red hat build of apache camel - hawtio 4
- red hat build of apicurio registry 2
- red hat build of kueue
- red hat build of optaplanner 8
- red hat connectivity link 1
- red hat data grid 8
- red hat developer hub
- red hat discovery 2
- red hat edge manager 1.0
- red hat edge manager 1.1
- red hat edge manager preview
- red hat enterprise linux 10
- red hat enterprise linux 8
- red hat enterprise linux 9
- red hat fuse 7
- red hat jboss enterprise application platform 8
- red hat jboss enterprise application platform expansion pack
- red hat migration toolkit 1.8
- red hat openshift ai (rhoai)
- red hat openshift ai 2.25
- red hat openshift ai 3.3
- red hat openshift container platform 4
- red hat openshift container platform 4.17
- red hat openshift container platform 4.18
- red hat openshift container platform 4.19
- red hat openshift container platform 4.20
- red hat openshift container platform 4.21
- red hat openshift data foundation 4.18
- red hat openshift data foundation 4.19
- red hat openshift data foundation 4.20
- red hat openshift dev spaces
- red hat openshift dev spaces (rhosds) 3.26
- red hat openshift distributed tracing 3
- red hat openshift gitops
- red hat openshift service mesh 3.0
- red hat openshift service mesh 3.1
- red hat openshift service mesh 3.2
- red hat openshift virtualization 4
- red hat process automation 7
- red hat quay 3
- red hat satellite 6
- red hat single sign-on 7
- red hat trusted artifact signer 1.3
Affected packages
| Package | Affected | Fixed |
|---|---|---|
react-routernpm |
7.0.0 to 7.11.0 | 7.12.0 |
@remix-run/routernpm |
through 1.23.1 | 1.23.2 |
@remix-run/routerTuxCare:npm |
1.23.0-tuxcare.0 up to 1.23.0-tuxcare.1, plus listed versions 1.23.0 |
1.23.0-tuxcare.1 |
@remix-run/routerTuxCare:npm |
1.15.3-tuxcare.0 up to 1.15.3-tuxcare.1, plus listed versions 1.15.3 |
1.15.3-tuxcare.1 |
@remix-run/routerTuxCare:npm |
1.6.2-tuxcare.0 up to 1.6.2-tuxcare.1, plus listed versions 1.6.2 |
1.6.2-tuxcare.1 |
react-routernpm |
7.0.0 up to 7.12.0 | 7.12.0 |
@remix-run/routernpm |
before 1.23.2 | 1.23.2 |
automation-platform-uiRed Hat:ansible_automation_platform:2.6::el9 From an advisory covering 14 CVEs |
before 0:2.6.6-1.el9ap | 0:2.6.6-1.el9ap |
python3.12-djangoRed Hat:ansible_automation_platform_developer:2.6::el9 From an advisory covering 14 CVEs |
before 0:4.2.28-1.el9ap | 0:4.2.28-1.el9ap |
python3.12-djangoRed Hat:ansible_automation_platform:2.6::el9 From an advisory covering 14 CVEs |
before 0:4.2.28-1.el9ap | 0:4.2.28-1.el9ap |
Show 80 moreShow less
| Package | Affected | Fixed |
|---|---|---|
receptorRed Hat:ansible_automation_platform:2.6::el10 From an advisory covering 14 CVEs |
before 0:1.6.3-4.el10ap | 0:1.6.3-4.el10ap |
receptor-debuginfoRed Hat:ansible_automation_platform:2.6::el10 From an advisory covering 14 CVEs |
before 0:1.6.3-4.el10ap | 0:1.6.3-4.el10ap |
receptor-debugsourceRed Hat:ansible_automation_platform:2.6::el10 From an advisory covering 14 CVEs |
before 0:1.6.3-4.el10ap | 0:1.6.3-4.el10ap |
receptorctlRed Hat:ansible_automation_platform:2.6::el10 From an advisory covering 14 CVEs |
before 0:1.6.3-4.el10ap | 0:1.6.3-4.el10ap |
receptorRed Hat:ansible_automation_platform_developer:2.6::el9 From an advisory covering 14 CVEs |
before 0:1.6.3-4.el9ap | 0:1.6.3-4.el9ap |
receptorctlRed Hat:ansible_automation_platform_developer:2.6::el9 From an advisory covering 14 CVEs |
before 0:1.6.3-4.el9ap | 0:1.6.3-4.el9ap |
receptorRed Hat:ansible_automation_platform_inside:2.6::el9 From an advisory covering 14 CVEs |
before 0:1.6.3-4.el9ap | 0:1.6.3-4.el9ap |
receptorctlRed Hat:ansible_automation_platform_inside:2.6::el9 From an advisory covering 14 CVEs |
before 0:1.6.3-4.el9ap | 0:1.6.3-4.el9ap |
receptorRed Hat:ansible_automation_platform:2.6::el9 From an advisory covering 14 CVEs |
before 0:1.6.3-4.el9ap | 0:1.6.3-4.el9ap |
receptor-debuginfoRed Hat:ansible_automation_platform:2.6::el9 From an advisory covering 14 CVEs |
before 0:1.6.3-4.el9ap | 0:1.6.3-4.el9ap |
receptor-debugsourceRed Hat:ansible_automation_platform:2.6::el9 From an advisory covering 14 CVEs |
before 0:1.6.3-4.el9ap | 0:1.6.3-4.el9ap |
receptorctlRed Hat:ansible_automation_platform:2.6::el9 From an advisory covering 14 CVEs |
before 0:1.6.3-4.el9ap | 0:1.6.3-4.el9ap |
python3.12-aiohttpRed Hat:ansible_automation_platform:2.6::el9 From an advisory covering 14 CVEs |
before 0:3.13.3-2.el9ap | 0:3.13.3-2.el9ap |
python3.12-aiohttp-debuginfoRed Hat:ansible_automation_platform:2.6::el9 From an advisory covering 14 CVEs |
before 0:3.13.3-2.el9ap | 0:3.13.3-2.el9ap |
python3.12-aiohttp-debugsourceRed Hat:ansible_automation_platform:2.6::el9 From an advisory covering 14 CVEs |
before 0:3.13.3-2.el9ap | 0:3.13.3-2.el9ap |
python3.12-protobufRed Hat:ansible_automation_platform:2.6::el9 From an advisory covering 14 CVEs |
before 0:5.29.6-1.el9ap | 0:5.29.6-1.el9ap |
python3.12-protobuf-debuginfoRed Hat:ansible_automation_platform:2.6::el9 From an advisory covering 14 CVEs |
before 0:5.29.6-1.el9ap | 0:5.29.6-1.el9ap |
python3.12-protobuf-debugsourceRed Hat:ansible_automation_platform:2.6::el9 From an advisory covering 14 CVEs |
before 0:5.29.6-1.el9ap | 0:5.29.6-1.el9ap |
automation-controllerRed Hat:ansible_automation_platform_developer:2.6::el9 From an advisory covering 14 CVEs |
before 0:4.7.9-1.el9ap | 0:4.7.9-1.el9ap |
automation-controller-cliRed Hat:ansible_automation_platform_developer:2.6::el9 From an advisory covering 14 CVEs |
before 0:4.7.9-1.el9ap | 0:4.7.9-1.el9ap |
automation-controllerRed Hat:ansible_automation_platform:2.6::el9 From an advisory covering 14 CVEs |
before 0:4.7.9-1.el9ap | 0:4.7.9-1.el9ap |
automation-controller-cliRed Hat:ansible_automation_platform:2.6::el9 From an advisory covering 14 CVEs |
before 0:4.7.9-1.el9ap | 0:4.7.9-1.el9ap |
automation-controller-serverRed Hat:ansible_automation_platform:2.6::el9 From an advisory covering 14 CVEs |
before 0:4.7.9-1.el9ap | 0:4.7.9-1.el9ap |
automation-controller-uiRed Hat:ansible_automation_platform:2.6::el9 From an advisory covering 14 CVEs |
before 0:4.7.9-1.el9ap | 0:4.7.9-1.el9ap |
automation-controller-venv-towerRed Hat:ansible_automation_platform:2.6::el9 From an advisory covering 14 CVEs |
before 0:4.7.9-1.el9ap | 0:4.7.9-1.el9ap |
python3.12-djangoRed Hat:ansible_automation_platform_developer:2.5::el8 From an advisory covering 11 CVEs |
before 0:4.2.28-1.el8ap | 0:4.2.28-1.el8ap |
python3.12-djangoRed Hat:ansible_automation_platform:2.5::el8 From an advisory covering 11 CVEs |
before 0:4.2.28-1.el8ap | 0:4.2.28-1.el8ap |
python3.12-djangoRed Hat:ansible_automation_platform_developer:2.5::el9 From an advisory covering 11 CVEs |
before 0:4.2.28-1.el9ap | 0:4.2.28-1.el9ap |
python3.12-djangoRed Hat:ansible_automation_platform:2.5::el9 From an advisory covering 11 CVEs |
before 0:4.2.28-1.el9ap | 0:4.2.28-1.el9ap |
receptorRed Hat:ansible_automation_platform_developer:2.5::el8 From an advisory covering 11 CVEs |
before 0:1.6.3-4.el8ap | 0:1.6.3-4.el8ap |
receptorctlRed Hat:ansible_automation_platform_developer:2.5::el8 From an advisory covering 11 CVEs |
before 0:1.6.3-4.el8ap | 0:1.6.3-4.el8ap |
receptorRed Hat:ansible_automation_platform_inside:2.5::el8 From an advisory covering 11 CVEs |
before 0:1.6.3-4.el8ap | 0:1.6.3-4.el8ap |
receptorctlRed Hat:ansible_automation_platform_inside:2.5::el8 From an advisory covering 11 CVEs |
before 0:1.6.3-4.el8ap | 0:1.6.3-4.el8ap |
receptorRed Hat:ansible_automation_platform:2.5::el8 From an advisory covering 11 CVEs |
before 0:1.6.3-4.el8ap | 0:1.6.3-4.el8ap |
receptor-debuginfoRed Hat:ansible_automation_platform:2.5::el8 From an advisory covering 11 CVEs |
before 0:1.6.3-4.el8ap | 0:1.6.3-4.el8ap |
receptor-debugsourceRed Hat:ansible_automation_platform:2.5::el8 From an advisory covering 11 CVEs |
before 0:1.6.3-4.el8ap | 0:1.6.3-4.el8ap |
receptorctlRed Hat:ansible_automation_platform:2.5::el8 From an advisory covering 11 CVEs |
before 0:1.6.3-4.el8ap | 0:1.6.3-4.el8ap |
receptorRed Hat:ansible_automation_platform_developer:2.5::el9 From an advisory covering 11 CVEs |
before 0:1.6.3-4.el9ap | 0:1.6.3-4.el9ap |
receptorctlRed Hat:ansible_automation_platform_developer:2.5::el9 From an advisory covering 11 CVEs |
before 0:1.6.3-4.el9ap | 0:1.6.3-4.el9ap |
receptorRed Hat:ansible_automation_platform_inside:2.5::el9 From an advisory covering 11 CVEs |
before 0:1.6.3-4.el9ap | 0:1.6.3-4.el9ap |
receptorctlRed Hat:ansible_automation_platform_inside:2.5::el9 From an advisory covering 11 CVEs |
before 0:1.6.3-4.el9ap | 0:1.6.3-4.el9ap |
receptorRed Hat:ansible_automation_platform:2.5::el9 From an advisory covering 11 CVEs |
before 0:1.6.3-4.el9ap | 0:1.6.3-4.el9ap |
receptor-debuginfoRed Hat:ansible_automation_platform:2.5::el9 From an advisory covering 11 CVEs |
before 0:1.6.3-4.el9ap | 0:1.6.3-4.el9ap |
receptor-debugsourceRed Hat:ansible_automation_platform:2.5::el9 From an advisory covering 11 CVEs |
before 0:1.6.3-4.el9ap | 0:1.6.3-4.el9ap |
receptorctlRed Hat:ansible_automation_platform:2.5::el9 From an advisory covering 11 CVEs |
before 0:1.6.3-4.el9ap | 0:1.6.3-4.el9ap |
python3.12-aiohttpRed Hat:ansible_automation_platform:2.5::el8 From an advisory covering 11 CVEs |
before 0:3.13.3-2.el8ap | 0:3.13.3-2.el8ap |
python3.12-aiohttp-debuginfoRed Hat:ansible_automation_platform:2.5::el8 From an advisory covering 11 CVEs |
before 0:3.13.3-2.el8ap | 0:3.13.3-2.el8ap |
python3.12-aiohttp-debugsourceRed Hat:ansible_automation_platform:2.5::el8 From an advisory covering 11 CVEs |
before 0:3.13.3-2.el8ap | 0:3.13.3-2.el8ap |
python3.12-aiohttpRed Hat:ansible_automation_platform:2.5::el9 From an advisory covering 11 CVEs |
before 0:3.13.3-2.el9ap | 0:3.13.3-2.el9ap |
python3.12-aiohttp-debuginfoRed Hat:ansible_automation_platform:2.5::el9 From an advisory covering 11 CVEs |
before 0:3.13.3-2.el9ap | 0:3.13.3-2.el9ap |
python3.12-aiohttp-debugsourceRed Hat:ansible_automation_platform:2.5::el9 From an advisory covering 11 CVEs |
before 0:3.13.3-2.el9ap | 0:3.13.3-2.el9ap |
python3.12-protobufRed Hat:ansible_automation_platform:2.5::el8 From an advisory covering 11 CVEs |
before 0:5.29.6-1.el8ap | 0:5.29.6-1.el8ap |
python3.12-protobuf-debuginfoRed Hat:ansible_automation_platform:2.5::el8 From an advisory covering 11 CVEs |
before 0:5.29.6-1.el8ap | 0:5.29.6-1.el8ap |
python3.12-protobuf-debugsourceRed Hat:ansible_automation_platform:2.5::el8 From an advisory covering 11 CVEs |
before 0:5.29.6-1.el8ap | 0:5.29.6-1.el8ap |
python3.12-protobufRed Hat:ansible_automation_platform:2.5::el9 From an advisory covering 11 CVEs |
before 0:5.29.6-1.el9ap | 0:5.29.6-1.el9ap |
python3.12-protobuf-debuginfoRed Hat:ansible_automation_platform:2.5::el9 From an advisory covering 11 CVEs |
before 0:5.29.6-1.el9ap | 0:5.29.6-1.el9ap |
python3.12-protobuf-debugsourceRed Hat:ansible_automation_platform:2.5::el9 From an advisory covering 11 CVEs |
before 0:5.29.6-1.el9ap | 0:5.29.6-1.el9ap |
automation-gatewayRed Hat:ansible_automation_platform:2.5::el8 From an advisory covering 11 CVEs |
before 0:2.5.20260225-1.el8ap | 0:2.5.20260225-1.el8ap |
automation-gateway-configRed Hat:ansible_automation_platform:2.5::el8 From an advisory covering 11 CVEs |
before 0:2.5.20260225-1.el8ap | 0:2.5.20260225-1.el8ap |
automation-gateway-serverRed Hat:ansible_automation_platform:2.5::el8 From an advisory covering 11 CVEs |
before 0:2.5.20260225-1.el8ap | 0:2.5.20260225-1.el8ap |
automation-gatewayRed Hat:ansible_automation_platform:2.5::el9 From an advisory covering 11 CVEs |
before 0:2.5.20260225-1.el9ap | 0:2.5.20260225-1.el9ap |
automation-gateway-configRed Hat:ansible_automation_platform:2.5::el9 From an advisory covering 11 CVEs |
before 0:2.5.20260225-1.el9ap | 0:2.5.20260225-1.el9ap |
automation-gateway-serverRed Hat:ansible_automation_platform:2.5::el9 From an advisory covering 11 CVEs |
before 0:2.5.20260225-1.el9ap | 0:2.5.20260225-1.el9ap |
automation-controllerRed Hat:ansible_automation_platform_developer:2.5::el8 From an advisory covering 11 CVEs |
before 0:4.6.26-1.el8ap | 0:4.6.26-1.el8ap |
automation-controller-cliRed Hat:ansible_automation_platform_developer:2.5::el8 From an advisory covering 11 CVEs |
before 0:4.6.26-1.el8ap | 0:4.6.26-1.el8ap |
automation-controllerRed Hat:ansible_automation_platform:2.5::el8 From an advisory covering 11 CVEs |
before 0:4.6.26-1.el8ap | 0:4.6.26-1.el8ap |
automation-controller-cliRed Hat:ansible_automation_platform:2.5::el8 From an advisory covering 11 CVEs |
before 0:4.6.26-1.el8ap | 0:4.6.26-1.el8ap |
automation-controller-serverRed Hat:ansible_automation_platform:2.5::el8 From an advisory covering 11 CVEs |
before 0:4.6.26-1.el8ap | 0:4.6.26-1.el8ap |
automation-controller-uiRed Hat:ansible_automation_platform:2.5::el8 From an advisory covering 11 CVEs |
before 0:4.6.26-1.el8ap | 0:4.6.26-1.el8ap |
automation-controller-venv-towerRed Hat:ansible_automation_platform:2.5::el8 From an advisory covering 11 CVEs |
before 0:4.6.26-1.el8ap | 0:4.6.26-1.el8ap |
automation-controllerRed Hat:ansible_automation_platform_developer:2.5::el9 From an advisory covering 11 CVEs |
before 0:4.6.26-1.el9ap | 0:4.6.26-1.el9ap |
automation-controller-cliRed Hat:ansible_automation_platform_developer:2.5::el9 From an advisory covering 11 CVEs |
before 0:4.6.26-1.el9ap | 0:4.6.26-1.el9ap |
automation-controllerRed Hat:ansible_automation_platform:2.5::el9 From an advisory covering 11 CVEs |
before 0:4.6.26-1.el9ap | 0:4.6.26-1.el9ap |
automation-controller-cliRed Hat:ansible_automation_platform:2.5::el9 From an advisory covering 11 CVEs |
before 0:4.6.26-1.el9ap | 0:4.6.26-1.el9ap |
automation-controller-serverRed Hat:ansible_automation_platform:2.5::el9 From an advisory covering 11 CVEs |
before 0:4.6.26-1.el9ap | 0:4.6.26-1.el9ap |
automation-controller-uiRed Hat:ansible_automation_platform:2.5::el9 From an advisory covering 11 CVEs |
before 0:4.6.26-1.el9ap | 0:4.6.26-1.el9ap |
automation-controller-venv-towerRed Hat:ansible_automation_platform:2.5::el9 From an advisory covering 11 CVEs |
before 0:4.6.26-1.el9ap | 0:4.6.26-1.el9ap |
@remix-run/routerRoot:npm |
before 1.6.0-aikido.1 | 1.6.0-aikido.11.16.1-aikido.11.11.0-aikido.1 |
@rootio/remix-run__routerRoot:npm |
before 1.6.0-root.io.1 | 1.6.0-root.io.11.16.1-root.io.11.11.0-root.io.1 |
heroic-games-launcheropenSUSE:Tumbleweed |
before 2.18.1-2.1 | 2.18.1-2.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-22029 is a high vulnerability (CVSS 8.0) in @tanstack React-router, published January 8, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.87%, the 58th percentile. Fixed in react-router 7.12.0.
References
github.com/remix-run/react-router/security/advisories/GHSA-2w69-qvjg-hvjx
access.redhat.com/security/cve/CVE-2026-22029
bugzilla.redhat.com/show_bug.cgi?id=2428412
security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-22029.json
Show 121 moreShow less
nvd.nist.gov/vuln/detail/CVE-2026-22029
docs.redhat.com/en/documentation/red_hat_ansible_automation_platform/2.6/html/release_notes/patch_releases
issues.redhat.com/browse/AAP-62864
cve.org/CVERecord?id=CVE-2025-13465
docs.djangoproject.com/en/dev/releases/security
groups.google.com/g/django-announce
djangoproject.com/weblog/2026/feb/03/security-releases
go.dev/cl/736712
pkg.go.dev/vuln/GO-2026-4341
suse.com/security/cve/CVE-2026-22029