CVE-2026-34077
React Router vulnerable to Denial of Service via reflected user input in single-fetch
React Router is a router for React. In versions 7.7.0 through 7.13.1, when using React Router's unstable React Server Components (RSC) APIs, there is a potential client-side Cross-Site Scripting (XSS) vulnerability in the RSC redirect handling if redirects come from untrusted sources. This does not impact applications that are not using the unstable RSC APIs in React Router. This is patched in version 7.13.2.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
React Router vulnerable to Denial of Service via reflected user input in single-fetch
React Router is a router for React. In versions 7.7.0 through 7.13.1, when using React Router's unstable React Server Components (RSC) APIs, there is a potential client-side Cross-Site Scripting (XSS) vulnerability in the RSC redirect handling if redirects come from untrusted sources. This does not impact applications that are not using the unstable RSC APIs in React Router. This is patched in version 7.13.2.
- Record
CVE-2026-34077- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-770
- Updated
- 2026-11-02
EUVDEUVD-2026-33994
React Router is a router for React. In versions 7.7.0 through 7.13.1, when using React Router's unstable React Server Components (RSC) APIs, there is a potential client-side Cross-Site Scripting (XSS) vulnerability in the RSC redirect handling if redirects come from untrusted sources. This does not impact applications that are not using the unstable RSC APIs in React Router. This is patched in version 7.13.2.
- Record
EUVD-2026-33994- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-rxv8-25v2-qmq8
React Router vulnerable to Denial of Service via reflected user input in single-fetch
A DoS vulnerability exists in the React Router v7 Framework Mode, as well as Remix v2.9.0+ with Single Fetch enabled. In some scenarios the underlying serialization algorithm can become a bottleneck when encoding specific types of data into server responses. Please upgrade to React Router v7.14.0 or later.
[!NOTE] This does not impact your React Router application if you are using Declarative Mode (
<BrowserRouter>) or Data Mode (createBrowserRouter/<RouterProvider>).
- Record
GHSA-rxv8-25v2-qmq8- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-770
- Updated
- 2026-11-02
NVD
React Router is a router for React. In versions 7.7.0 through 7.13.1, when using React Router's unstable React Server Components (RSC) APIs, there is a potential client-side Cross-Site Scripting (XSS) vulnerability in the RSC redirect handling if redirects come from untrusted sources. This does not impact applications that are not using the unstable RSC APIs in React Router. This is patched in version 7.13.2.
- Record
CVE-2026-34077- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-770
- Updated
- 2026-11-02
OSV
React Router vulnerable to Denial of Service via reflected user input in single-fetch
React Router is a router for React. In versions 7.7.0 through 7.13.1, when using React Router's unstable React Server Components (RSC) APIs, there is a potential client-side Cross-Site Scripting (XSS) vulnerability in the RSC redirect handling if redirects come from untrusted sources. This does not impact applications that are not using the unstable RSC APIs in React Router. This is patched in version 7.13.2.
- Record
CVE-2026-34077- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-770
- Updated
- 2026-11-02
OSVGHSA-rxv8-25v2-qmq8
React Router vulnerable to Denial of Service via reflected user input in single-fetch
A DoS vulnerability exists in the React Router v7 Framework Mode, as well as Remix v2.9.0+ with Single Fetch enabled. In some scenarios the underlying serialization algorithm can become a bottleneck when encoding specific types of data into server responses. Please upgrade to React Router v7.14.0 or later.
[!NOTE] This does not impact your React Router application if you are using Declarative Mode (
<BrowserRouter>) or Data Mode (createBrowserRouter/<RouterProvider>).
- Record
GHSA-rxv8-25v2-qmq8- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-770
- Updated
- 2026-11-02
Show 10 moreShow less
OSVCLSA-2026-1788960805 No score
TuxCare security update for 2 packages (3 CVEs)
TuxCare rebuilt 2 packages to address 3 CVEs. Fixed in 7.5.1-tuxcare.10.
- Record
CLSA-2026-1788960805- Updated
- 2026-11-02
OSVCLSA-2026-1792192714 No score
TuxCare security update for react-router (3 CVEs)
TuxCare rebuilt react-router to address 3 CVEs. Fixed in 7.13.1-tuxcare.1.
- Record
CLSA-2026-1792192714- Updated
- 2026-11-02
OSVCLSA-2026-1792253403 No score
TuxCare security update for react-router-dom (3 CVEs)
TuxCare rebuilt react-router-dom to address 3 CVEs. Fixed in 7.13.1-tuxcare.1.
- Record
CLSA-2026-1792253403- Updated
- 2026-11-02
OSVCLSA-2026-1792419115 No score
TuxCare security update for @react-router/architect (3 CVEs)
TuxCare rebuilt @react-router/architect to address 3 CVEs. Fixed in 7.5.1-tuxcare.10.
- Record
CLSA-2026-1792419115- Updated
- 2026-11-02
OSVCLSA-2026-1792419193 No score
TuxCare security update for @react-router/cloudflare (3 CVEs)
TuxCare rebuilt @react-router/cloudflare to address 3 CVEs. Fixed in 7.5.1-tuxcare.10.
- Record
CLSA-2026-1792419193- Updated
- 2026-11-02
OSVCLSA-2026-1792421947 No score
TuxCare security update for @react-router/remix-routes-option-adapter (3 CVEs)
TuxCare rebuilt @react-router/remix-routes-option-adapter to address 3 CVEs. Fixed in 7.5.1-tuxcare.10.
- Record
CLSA-2026-1792421947- Updated
- 2026-11-02
OSVCLSA-2026-1792425411 No score
TuxCare security update for @react-router/fs-routes (3 CVEs)
TuxCare rebuilt @react-router/fs-routes to address 3 CVEs. Fixed in 7.5.1-tuxcare.10.
- Record
CLSA-2026-1792425411- Updated
- 2026-11-02
OSVCLSA-2026-1792430035 No score
TuxCare security update for create-react-router (3 CVEs)
TuxCare rebuilt create-react-router to address 3 CVEs. Fixed in 7.5.1-tuxcare.10.
- Record
CLSA-2026-1792430035- Updated
- 2026-11-02
OSVopenSUSE-SU-2026:11128-1 No score
agama-web-ui-22+143.ee15dea20-46.1 on GA media
These are all security issues fixed in the agama-web-ui-22+143.ee15dea20-46.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2026:11128-1- Updated
- 2026-11-02
OSVROOT-APP-NPM-CVE-2026-34077 No score
CVE-2026-34077 in react-router - Patched by Root
Root has patched CVE-2026-34077 in the react-router package for Root:npm. Multiple fixed versions available.
- Record
ROOT-APP-NPM-CVE-2026-34077- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
react-routernpm |
7.0.0 up to 7.14.0 | 7.14.0 |
turbo-streamnpm |
before 3.0.0 | 3.0.0 |
react-routerTuxCare:npm From an advisory covering 2 CVEs |
7.5.1-tuxcare.0 up to 7.5.1-tuxcare.10, plus listed versions 7.5.17.5.1-tuxcare.17.5.1-tuxcare.27.5.1-tuxcare.37.5.1-tuxcare.4 Show 5 moreShow less7.5.1-tuxcare.57.5.1-tuxcare.67.5.1-tuxcare.77.5.1-tuxcare.87.5.1-tuxcare.9 |
7.5.1-tuxcare.10 |
react-router-devTuxCare:npm From an advisory covering 2 CVEs |
7.5.1-tuxcare.0 up to 7.5.1-tuxcare.10, plus listed versions 7.5.17.5.1-tuxcare.17.5.1-tuxcare.27.5.1-tuxcare.37.5.1-tuxcare.4 Show 5 moreShow less7.5.1-tuxcare.57.5.1-tuxcare.67.5.1-tuxcare.77.5.1-tuxcare.87.5.1-tuxcare.9 |
7.5.1-tuxcare.10 |
react-routerTuxCare:npm From an advisory covering 3 CVEs |
7.13.1-tuxcare.0 up to 7.13.1-tuxcare.1, plus listed versions 7.13.1 |
7.13.1-tuxcare.1 |
react-router-domTuxCare:npm From an advisory covering 3 CVEs |
7.13.1-tuxcare.0 up to 7.13.1-tuxcare.1, plus listed versions 7.13.1 |
7.13.1-tuxcare.1 |
@react-router/architectTuxCare:npm From an advisory covering 2 CVEs |
7.5.1-tuxcare.0 up to 7.5.1-tuxcare.10, plus listed versions 7.5.17.5.1-tuxcare.17.5.1-tuxcare.47.5.1-tuxcare.57.5.1-tuxcare.67.5.1-tuxcare.77.5.1-tuxcare.87.5.1-tuxcare.9 |
7.5.1-tuxcare.10 |
@react-router/cloudflareTuxCare:npm From an advisory covering 2 CVEs |
7.5.1-tuxcare.0 up to 7.5.1-tuxcare.10, plus listed versions 7.5.17.5.1-tuxcare.17.5.1-tuxcare.47.5.1-tuxcare.57.5.1-tuxcare.67.5.1-tuxcare.77.5.1-tuxcare.87.5.1-tuxcare.9 |
7.5.1-tuxcare.10 |
@react-router/remix-routes-option-adapterTuxCare:npm From an advisory covering 2 CVEs |
7.5.1-tuxcare.0 up to 7.5.1-tuxcare.10, plus listed versions 7.5.17.5.1-tuxcare.17.5.1-tuxcare.47.5.1-tuxcare.57.5.1-tuxcare.67.5.1-tuxcare.77.5.1-tuxcare.87.5.1-tuxcare.9 |
7.5.1-tuxcare.10 |
@react-router/fs-routesTuxCare:npm From an advisory covering 2 CVEs |
7.5.1-tuxcare.0 up to 7.5.1-tuxcare.10, plus listed versions 7.5.17.5.1-tuxcare.17.5.1-tuxcare.47.5.1-tuxcare.57.5.1-tuxcare.67.5.1-tuxcare.77.5.1-tuxcare.87.5.1-tuxcare.9 |
7.5.1-tuxcare.10 |
Show 4 moreShow less
| Package | Affected | Fixed |
|---|---|---|
create-react-routerTuxCare:npm From an advisory covering 2 CVEs |
7.5.1-tuxcare.0 up to 7.5.1-tuxcare.10, plus listed versions 7.5.17.5.1-tuxcare.17.5.1-tuxcare.47.5.1-tuxcare.57.5.1-tuxcare.67.5.1-tuxcare.77.5.1-tuxcare.87.5.1-tuxcare.9 |
7.5.1-tuxcare.10 |
react-routerRoot:npm |
before 7.12.0-aikido.2 | 7.12.0-aikido.27.12.0-aikido.3 |
@rootio/react-routerRoot:npm |
before 7.12.0-root.io.2 | 7.12.0-root.io.27.12.0-root.io.3 |
agama-web-uiopenSUSE:Tumbleweed |
before 22+143.ee15dea20-46.1 | 22+143.ee15dea20-46.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-34077 is a high vulnerability (CVSS 7.5) in @tanstack React-router, published June 2, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.29%, the 22nd percentile. Fixed in react-router 7.14.0.
References
github.com/remix-run/react-router/security/advisories/GHSA-rxv8-25v2-qmq8
nvd.nist.gov/vuln/detail/CVE-2026-34077
suse.com/security/cve/CVE-2026-34077