Every CVE Search/ Get API key

CVE-2026-42211

React Router's vendored turbo-stream v2 allows arbitrary constructor invocation via TYPE_ERROR deserialization leading to Unauth RCE

8.1 HighFix available

React Router is a router for React. In versions 7.0.0 through 7.14.1, when using Framework Mode, a combination of steps could potentially allow unauthorized remote code execution (RCE) through external requests. This attack requires the application code to have an existing prototype pollution vulnerability, which can then be leveraged in a 2-step attack where the second step triggers unauthorized RCE on the remote server. This does not impact applications using Declarative Mode (<BrowserRouter>) or Data Mode (createBrowserRouter/<RouterProvider>). This is patched in version 7.14.2.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
High
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
High

Exploit likelihood

0.42%Up 0.2 points since Jun 3, 2026
90%50%10%1%

What each source reports

CVE List Score used 8.1

React Router's vendored turbo-stream v2 allows arbitrary constructor invocation via TYPE_ERROR deserialization leading to Unauth RCE

React Router is a router for React. In versions 7.0.0 through 7.14.1, when using Framework Mode, a combination of steps could potentially allow unauthorized remote code execution (RCE) through external requests. This attack requires the application code to have an existing prototype pollution vulnerability, which can then be leveraged in a 2-step attack where the second step triggers unauthorized RCE on the remote server. This does not impact applications using Declarative Mode (<BrowserRouter>) or Data Mode (createBrowserRouter/<RouterProvider>). This is patched in version 7.14.2.

Record
CVE-2026-42211
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-502
Updated
2026-11-02
EUVDEUVD-2026-33999 8.1

React Router is a router for React. In versions 7.0.0 through 7.14.1, when using Framework Mode, a combination of steps could potentially allow unauthorized remote code execution (RCE) through external requests. This attack requires the application code to have an existing prototype pollution vulnerability, which can then be leveraged in a 2-step attack where the second step triggers unauthorized RCE on the remote server. This does not impact applications using Declarative Mode (<BrowserRouter>) or Data Mode (createBrowserRouter/<RouterProvider>). This is patched in version 7.14.2.

Record
EUVD-2026-33999
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
GitHub AdvisoriesGHSA-49rj-9fvp-4h2h 8.1

React Router's vendored turbo-stream v2 allows arbitrary constructor invocation via TYPE_ERROR deserialization leading to Unauth RCE

When using React Router v7 in Framework Mode, there exists a combination of steps that could potentially allow unauthorized RCE through external requests. This first requires the application code to have an existing prototype pollution vulnerability. This can be leveraged into a 2-step attack in which the second step can trigger unauthorized RCE on the remote server.

[!NOTE] This does not impact your React Router application if you are using Declarative Mode (<BrowserRouter>) or Data Mode (createBrowserRouter/<RouterProvider>).

Record
GHSA-49rj-9fvp-4h2h
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-502
Updated
2026-11-02
NVD 8.1

React Router is a router for React. In versions 7.0.0 through 7.14.1, when using Framework Mode, a combination of steps could potentially allow unauthorized remote code execution (RCE) through external requests. This attack requires the application code to have an existing prototype pollution vulnerability, which can then be leveraged in a 2-step attack where the second step triggers unauthorized RCE on the remote server. This does not impact applications using Declarative Mode (<BrowserRouter>) or Data Mode (createBrowserRouter/<RouterProvider>). This is patched in version 7.14.2.

Record
CVE-2026-42211
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-502
Updated
2026-11-02
OSV 8.1

React Router's vendored turbo-stream v2 allows arbitrary constructor invocation via TYPE_ERROR deserialization leading to Unauth RCE

React Router is a router for React. In versions 7.0.0 through 7.14.1, when using Framework Mode, a combination of steps could potentially allow unauthorized remote code execution (RCE) through external requests. This attack requires the application code to have an existing prototype pollution vulnerability, which can then be leveraged in a 2-step attack where the second step triggers unauthorized RCE on the remote server. This does not impact applications using Declarative Mode (<BrowserRouter>) or Data Mode (createBrowserRouter/<RouterProvider>). This is patched in version 7.14.2.

Record
CVE-2026-42211
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-502
Updated
2026-11-02
OSVGHSA-49rj-9fvp-4h2h 8.1

React Router's vendored turbo-stream v2 allows arbitrary constructor invocation via TYPE_ERROR deserialization leading to Unauth RCE

When using React Router v7 in Framework Mode, there exists a combination of steps that could potentially allow unauthorized RCE through external requests. This first requires the application code to have an existing prototype pollution vulnerability. This can be leveraged into a 2-step attack in which the second step can trigger unauthorized RCE on the remote server.

[!NOTE] This does not impact your React Router application if you are using Declarative Mode (<BrowserRouter>) or Data Mode (createBrowserRouter/<RouterProvider>).

Record
GHSA-49rj-9fvp-4h2h
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-502
Updated
2026-11-02
Show 18 moreShow less
OSVRHSA-2026:29770 8.1

Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

Record
RHSA-2026:29770
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVCLSA-2026-1784856365 No score

TuxCare security update for react-router (1 CVE)

TuxCare rebuilt react-router to address 1 CVE. Fixed in 7.5.1-tuxcare.6.

Record
CLSA-2026-1784856365
Updated
2026-11-02
OSVCLSA-2026-1792192812 No score

TuxCare security update for react-router (1 CVE)

TuxCare rebuilt react-router to address 1 CVE. Fixed in 7.14.1-tuxcare.1.

Record
CLSA-2026-1792192812
Updated
2026-11-02
OSVCLSA-2026-1792253397 No score

TuxCare security update for react-router-dom (1 CVE)

TuxCare rebuilt react-router-dom to address 1 CVE. Fixed in 7.5.1-tuxcare.6.

Record
CLSA-2026-1792253397
Updated
2026-11-02
OSVCLSA-2026-1792253409 No score

TuxCare security update for react-router-dom (1 CVE)

TuxCare rebuilt react-router-dom to address 1 CVE. Fixed in 7.14.1-tuxcare.1.

Record
CLSA-2026-1792253409
Updated
2026-11-02
OSVCLSA-2026-1792419112 No score

TuxCare security update for @react-router/architect (1 CVE)

TuxCare rebuilt @react-router/architect to address 1 CVE. Fixed in 7.5.1-tuxcare.6.

Record
CLSA-2026-1792419112
Updated
2026-11-02
OSVCLSA-2026-1792419189 No score

TuxCare security update for @react-router/cloudflare (1 CVE)

TuxCare rebuilt @react-router/cloudflare to address 1 CVE. Fixed in 7.5.1-tuxcare.6.

Record
CLSA-2026-1792419189
Updated
2026-11-02
OSVCLSA-2026-1792419268 No score

TuxCare security update for @react-router/express (1 CVE)

TuxCare rebuilt @react-router/express to address 1 CVE. Fixed in 7.5.1-tuxcare.6.

Record
CLSA-2026-1792419268
Updated
2026-11-02
OSVCLSA-2026-1792419624 No score

TuxCare security update for @react-router/node (1 CVE)

TuxCare rebuilt @react-router/node to address 1 CVE. Fixed in 7.5.1-tuxcare.6.

Record
CLSA-2026-1792419624
Updated
2026-11-02
OSVCLSA-2026-1792421942 No score

TuxCare security update for @react-router/remix-routes-option-adapter (1 CVE)

TuxCare rebuilt @react-router/remix-routes-option-adapter to address 1 CVE. Fixed in 7.5.1-tuxcare.6.

Record
CLSA-2026-1792421942
Updated
2026-11-02
OSVCLSA-2026-1792424731 No score

TuxCare security update for @react-router/dev (1 CVE)

TuxCare rebuilt @react-router/dev to address 1 CVE. Fixed in 7.5.1-tuxcare.6.

Record
CLSA-2026-1792424731
Updated
2026-11-02
OSVCLSA-2026-1792425406 No score

TuxCare security update for @react-router/fs-routes (1 CVE)

TuxCare rebuilt @react-router/fs-routes to address 1 CVE. Fixed in 7.5.1-tuxcare.6.

Record
CLSA-2026-1792425406
Updated
2026-11-02
OSVCLSA-2026-1792428106 No score

TuxCare security update for @react-router/serve (1 CVE)

TuxCare rebuilt @react-router/serve to address 1 CVE. Fixed in 7.5.1-tuxcare.6.

Record
CLSA-2026-1792428106
Updated
2026-11-02
OSVCLSA-2026-1792430031 No score

TuxCare security update for create-react-router (1 CVE)

TuxCare rebuilt create-react-router to address 1 CVE. Fixed in 7.5.1-tuxcare.6.

Record
CLSA-2026-1792430031
Updated
2026-11-02
OSVCLSA-2026-1793102180 No score

TuxCare security update for react-router (5 CVEs)

TuxCare rebuilt react-router to address 5 CVEs. Fixed in 7.13.1-tuxcare.2.

Record
CLSA-2026-1793102180
Updated
2026-11-06
OSVROOT-APP-NPM-CVE-2026-42211 No score

CVE-2026-42211 in react-router - Patched by Root

Root has patched CVE-2026-42211 in the react-router package for Root:npm. Multiple fixed versions available.

Record
ROOT-APP-NPM-CVE-2026-42211
Updated
2026-11-02
OSVSUSE-SU-2026:4585-1 No score

Security update 5.2.1 for Multi-Linux Manager Client Tools

This update fixes the following issues:

golang-github-prometheus-prometheus was updated to version 3.13.2:

  • Security issues:

    • CVE-2026-39821: Fixed validation bypass and privilege escalation in Punycode label handling (bsc#1266608)
    • CVE-2026-56852: Fixed infinite loop on truncated or invalid UTF-8 input in unicode/norm handling (bsc#1272102)
    • CVE-2026-44990: Fixed stored XSS in the new React UI by sanitizing disallowed xmp elements (bsc#1275205)
    • CVE-2026-53606: Fixed incomplete URI scheme validation in sanitize-html that could enable XSS (bsc#1269966)
    • CVE-2026-2303: Fixed heap out-of-bounds read in GSSAPI error handling in mongo-driver (bsc#1269856)
    • CVE-2025-4673: Fixed credential leaks by stopping HTTP client header forwarding on redirects (bsc#1275206)
    • CVE-2023-45289: Fixed credential leaks by stopping header and cookie forwarding on HTTP redirects (bsc#1275207)
    • CVE-2025-61686: Fixed unauthorized file access and path traversal in react-router storage (bsc#1270711)
    • CVE-2026-40181: Fixed open redirect risks to external domains via relative paths in react-router (bsc#1267528)
    • CVE-2026-42342: Fixed DoS risks via unbounded path expansion in the manifest endpoint (bsc#1267538)
    • CVE-2026-42211: Fixed remote code execution risks from prototype pollution in react-router (bsc#1267534)
    • CVE-2026-39882: Fixed memory exhaustion via uncapped HTTP response reading in OpenTelemetry (bsc#1274221)
    • Fixed potential denial-of-service vulnerabilities by updating the gRPC dependency
    • Fixed memory exhaustion and DoS by rejecting snappy-compressed requests exceeding 32MB limit

  • Bug fixes and changes:

    • Fixed scrape manager failing to reload properly when SD configuration changes rapidly.
    • Prevent memory leak in remote-write path when the receiving endpoint is unavailable.
    • Native Histograms are no longer experimental. They are fully supported for production workloads.
    • Added support for OpenTelemetry traces within the Prometheus UI to correlate metrics and traces.
    • TSDB compaction speed optimized by improving the block merging algorithm.
    • Allow scraping of multiple targets using a single HTTP/2 connection to reduce overhead.
    • Added new metrics to monitor the health of the rule evaluation engine.
    • Incompatible: This affects scraping, remote read and write, alerting, and SD. Network paths might need adjustments to avoid redirects.
    • Incompatible: Rule group pagination tokens now use SHA-256 instead of MD5. Custom API consumers must adapt to the new longer token format.
    • Added 'group_limit' parameter to PromQL aggregations to restrict the number of results.
    • Incompatible: promtool relative paths in config files now resolve relative to the config directory itself, instead of the current working directory.
    • Support exporting TSDB blocks directly to cloud storage via the admin API.
    • Incompatible: Deprecated remote-write metrics like prometheus_remote_storage_samples_total are removed in favor of prometheus_wal_watcher_records_read_total.
    • Significant query performance boost for high-cardinality regex matchers.
    • Introduce a new UI interface for safely deleting specific time series data directly.
    • Added dynamic relabeling actions to extract substrings using regex capture groups.
    • Fixed UI displaying incorrect time ranges after a timezone change.
    • Bumped firewalld-prometheus-config to version 0.2 bumping OpenTelemetry to 1.43.0

grafana was updated to version 12.4.10:

  • Security issues:

    • CVE-2026-17183: Fixed exposing data accessible through Grafana's configured datasource credentials (bsc#1275934)
    • CVE-2026-2303: Fixed heap out-of-bounds read in GSSAPI error handling in mongo-driver (bsc#1269841)
    • CVE-2026-17033: Fixed stored cross-site scripting risks via malicious Alertmanager generator URLs (bsc#1276426)
    • CVE-2026-73501: Fixed fail-open authentication bypass in kin-openapi default handlers (bsc#1276973) *…
Record
SUSE-SU-2026:4585-1
Updated
2026-11-02
OSVSUSE-SU-2026:4606-1 No score

Security update for golang-github-prometheus-prometheus

This update for golang-github-prometheus-prometheus fixes the following issues:

golang-github-prometheus-prometheus was updated to version 3.13.2:

  • Security issues:

    • CVE-2026-39821: Fixed validation bypass and privilege escalation in Punycode label handling (bsc#1266608)
    • CVE-2026-56852: Fixed infinite loop on truncated or invalid UTF-8 input in unicode/norm handling (bsc#1272102)
    • CVE-2026-44990: Fixed stored XSS in the new React UI by sanitizing disallowed xmp elements (bsc#1275205)
    • CVE-2026-53606: Fixed incomplete URI scheme validation in sanitize-html that could enable XSS (bsc#1269966)
    • CVE-2026-2303: Fixed heap out-of-bounds read in GSSAPI error handling in mongo-driver (bsc#1269856)
    • CVE-2025-4673: Fixed credential leaks by stopping HTTP client header forwarding on redirects (bsc#1275206)
    • CVE-2023-45289: Fixed credential leaks by stopping header and cookie forwarding on HTTP redirects (bsc#1275207)
    • CVE-2025-61686: Fixed unauthorized file access and path traversal in react-router storage (bsc#1270711)
    • CVE-2026-40181: Fixed open redirect risks to external domains via relative paths in react-router (bsc#1267528)
    • CVE-2026-42342: Fixed DoS risks via unbounded path expansion in the manifest endpoint (bsc#1267538)
    • CVE-2026-42211: Fixed remote code execution risks from prototype pollution in react-router (bsc#1267534)
    • CVE-2026-39882: Fixed memory exhaustion via uncapped HTTP response reading in OpenTelemetry (bsc#1274221)
    • Fixed potential denial-of-service vulnerabilities by updating the gRPC dependency
    • Fixed memory exhaustion and DoS by rejecting snappy-compressed requests exceeding 32MB limit

  • Bug fixes and changes:

    • Fixed scrape manager failing to reload properly when SD configuration changes rapidly.
    • Prevent memory leak in remote-write path when the receiving endpoint is unavailable.
    • Native Histograms are no longer experimental. They are fully supported for production workloads.
    • Added support for OpenTelemetry traces within the Prometheus UI to correlate metrics and traces.
    • TSDB compaction speed optimized by improving the block merging algorithm.
    • Allow scraping of multiple targets using a single HTTP/2 connection to reduce overhead.
    • Added new metrics to monitor the health of the rule evaluation engine.
    • Incompatible: This affects scraping, remote read and write, alerting, and SD. Network paths might need adjustments to avoid redirects.
    • Incompatible: Rule group pagination tokens now use SHA-256 instead of MD5. Custom API consumers must adapt to the new longer token format.
    • Added 'group_limit' parameter to PromQL aggregations to restrict the number of results.
    • Incompatible: promtool relative paths in config files now resolve relative to the config directory itself, instead of the current working directory.
    • Support exporting TSDB blocks directly to cloud storage via the admin API.
    • Incompatible: Deprecated remote-write metrics like prometheus_remote_storage_samples_total are removed in favor of prometheus_wal_watcher_records_read_total.
    • Significant query performance boost for high-cardinality regex matchers.
    • Introduce a new UI interface for safely deleting specific time series data directly.
    • Added dynamic relabeling actions to extract substrings using regex capture groups.
    • Fixed UI displaying incorrect time ranges after a timezone change.
    • Bumped firewalld-prometheus-config to version 0.2 bumping OpenTelemetry to 1.43.0
Record
SUSE-SU-2026:4606-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
react-router
npm
 7.0.0 to 7.14.1
7.14.2
react-router
TuxCare:npm
 7.5.1-tuxcare.0 up to 7.5.1-tuxcare.6, plus listed versions
7.5.17.5.1-tuxcare.17.5.1-tuxcare.27.5.1-tuxcare.37.5.1-tuxcare.47.5.1-tuxcare.5
7.5.1-tuxcare.6
react-router
TuxCare:npm
 7.14.1-tuxcare.0 up to 7.14.1-tuxcare.1, plus listed versions
7.14.1
7.14.1-tuxcare.1
react-router-dom
TuxCare:npm
 7.5.1-tuxcare.0 up to 7.5.1-tuxcare.6, plus listed versions
7.5.17.5.1-tuxcare.17.5.1-tuxcare.47.5.1-tuxcare.5
7.5.1-tuxcare.6
react-router-dom
TuxCare:npm
 7.14.1-tuxcare.0 up to 7.14.1-tuxcare.1, plus listed versions
7.14.1
7.14.1-tuxcare.1
@react-router/architect
TuxCare:npm
 7.5.1-tuxcare.0 up to 7.5.1-tuxcare.6, plus listed versions
7.5.17.5.1-tuxcare.17.5.1-tuxcare.47.5.1-tuxcare.5
7.5.1-tuxcare.6
@react-router/cloudflare
TuxCare:npm
 7.5.1-tuxcare.0 up to 7.5.1-tuxcare.6, plus listed versions
7.5.17.5.1-tuxcare.17.5.1-tuxcare.47.5.1-tuxcare.5
7.5.1-tuxcare.6
@react-router/express
TuxCare:npm
 7.5.1-tuxcare.0 up to 7.5.1-tuxcare.6, plus listed versions
7.5.17.5.1-tuxcare.17.5.1-tuxcare.47.5.1-tuxcare.5
7.5.1-tuxcare.6
@react-router/node
TuxCare:npm
 7.5.1-tuxcare.0 up to 7.5.1-tuxcare.6, plus listed versions
7.5.17.5.1-tuxcare.17.5.1-tuxcare.47.5.1-tuxcare.5
7.5.1-tuxcare.6
@react-router/remix-routes-option-adapter
TuxCare:npm
 7.5.1-tuxcare.0 up to 7.5.1-tuxcare.6, plus listed versions
7.5.17.5.1-tuxcare.17.5.1-tuxcare.47.5.1-tuxcare.5
7.5.1-tuxcare.6
Show 19 moreShow less
Affected packages
PackageAffectedFixed
@react-router/dev
TuxCare:npm
 7.5.1-tuxcare.0 up to 7.5.1-tuxcare.6, plus listed versions
7.5.17.5.1-tuxcare.17.5.1-tuxcare.47.5.1-tuxcare.5
7.5.1-tuxcare.6
@react-router/fs-routes
TuxCare:npm
 7.5.1-tuxcare.0 up to 7.5.1-tuxcare.6, plus listed versions
7.5.17.5.1-tuxcare.17.5.1-tuxcare.47.5.1-tuxcare.5
7.5.1-tuxcare.6
@react-router/serve
TuxCare:npm
 7.5.1-tuxcare.0 up to 7.5.1-tuxcare.6, plus listed versions
7.5.17.5.1-tuxcare.17.5.1-tuxcare.47.5.1-tuxcare.5
7.5.1-tuxcare.6
create-react-router
TuxCare:npm
 7.5.1-tuxcare.0 up to 7.5.1-tuxcare.6, plus listed versions
7.5.17.5.1-tuxcare.17.5.1-tuxcare.47.5.1-tuxcare.5
7.5.1-tuxcare.6
react-router
TuxCare:npm
From an advisory covering 5 CVEs
 7.13.1-tuxcare.0 up to 7.13.1-tuxcare.2, plus listed versions
7.13.17.13.1-tuxcare.1
7.13.1-tuxcare.2
react-router
npm
 7.0.0 up to 7.14.2
7.14.2
opentelemetry-collector-contrib
Red Hat:hummingbird:1
From an advisory covering 3 CVEs
 before 0:0.155.0-0.1.hum1
0:0.155.0-0.1.hum1
react-router
Root:npm
 before 7.12.0-aikido.1
7.12.0-aikido.17.12.0-aikido.27.12.0-aikido.3
@rootio/react-router
Root:npm
 before 7.12.0-root.io.1
7.12.0-root.io.17.12.0-root.io.27.12.0-root.io.3
golang-github-prometheus-prometheus
SUSE:Multi Linux Manager Tools SLE-15
From an advisory covering 58 CVEs
 before 3.13.2-150002.3.19.1
3.13.2-150002.3.19.1
grafana
SUSE:Multi Linux Manager Tools SLE-15
From an advisory covering 58 CVEs
 before 12.4.10-150002.4.27.1
12.4.10-150002.4.27.1
mgr-push
SUSE:Multi Linux Manager Tools SLE-15
From an advisory covering 58 CVEs
 before 5.2.5-150002.3.12.1
5.2.5-150002.3.12.1
spacecmd
SUSE:Multi Linux Manager Tools SLE-15
From an advisory covering 58 CVEs
 before 5.2.10-150002.3.15.1
5.2.10-150002.3.15.1
spacewalk-client-tools
SUSE:Multi Linux Manager Tools SLE-15
From an advisory covering 58 CVEs
 before 5.2.7-150002.3.12.1
5.2.7-150002.3.12.1
uyuni-tools
SUSE:Multi Linux Manager Tools SLE-15
From an advisory covering 58 CVEs
 before 5.2.17-150002.3.20.1
5.2.17-150002.3.20.1
venv-salt-minion
SUSE:Multi Linux Manager Tools SLE-15
From an advisory covering 58 CVEs
 before 3006.0-150002.5.22.1
3006.0-150002.5.22.1
uyuni-tools
SUSE:Multi Linux Manager Tools SLE-Micro-5
From an advisory covering 58 CVEs
 before 5.2.17-150002.3.20.1
5.2.17-150002.3.20.1
venv-salt-minion
SUSE:Multi Linux Manager Tools SLE-Micro-5
From an advisory covering 58 CVEs
 before 3006.0-150002.5.22.1
3006.0-150002.5.22.1
golang-github-prometheus-prometheus
SUSE:Linux Enterprise Module for Package Hub 15 SP7
From an advisory covering 11 CVEs
 before 3.13.2-150100.4.40.2
3.13.2-150100.4.40.2

History

History
RecordedChangedSources
affectedOSV
affected, facts
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-42211 is a high vulnerability (CVSS 8.1) in @tanstack React-router, published June 2, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.42%, the 36th percentile. Fixed in react-router 7.14.2.

References

Show 159 moreShow less
This page doesn't list everything

Left out here: the rest of 1 source description. The JSON record has them.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open