CVE-2026-53667
React Router: Cross-site Scripting is Possible due to Missing RSCErrorHandler Protocol Validation (Incomplete fix for CVE-2026-53667)
React Router is a router for React. In versions 7.11.0 through 7.17.0, the RSCErrorHandler is missing protocol validation, allowing for redirects from untrusted sources. This issue is a follow up to CVE-2026-53667, and only affects consuming applications if they are using the unstable RSC APIs. This issue has been fixed in version 7.18.0.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- High
- Integrity
- Low
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
React Router: Cross-site Scripting is Possible due to Missing RSCErrorHandler Protocol Validation (Incomplete fix for CVE-2026-53667)
React Router is a router for React. In versions 7.11.0 through 7.17.0, the RSCErrorHandler is missing protocol validation, allowing for redirects from untrusted sources. This issue is a follow up to CVE-2026-53667, and only affects consuming applications if they are using the unstable RSC APIs. This issue has been fixed in version 7.18.0.
- Record
CVE-2026-53667- CVSS 3.1
- 6.9 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:L/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
EUVDEUVD-2026-49629
React Router is a router for React. In versions 7.11.0 through 7.17.0, the RSCErrorHandler is missing protocol validation, allowing for redirects from untrusted sources. This issue is a follow up to CVE-2026-53667, and only affects consuming applications if they are using the unstable RSC APIs. This issue has been fixed in version 7.18.0.
- Record
EUVD-2026-49629- CVSS 3.1
- 6.9 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:L/A:N - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-h8fp-f39c-q6mh
React Router: RSCErrorHandler Missing Protocol Validation (XSS)
This is a follow up to https://github.com/remix-run/react-router/security/advisories/GHSA-8646-j5j9-6r62. React Router was alerted of a code path in the (unstable) RSC error handling path in which redirects from untrusted sources could still result in an XSS vector via attacker-supplied redirect targets
[!NOTE] This only affects your application if you are using the unstable RSC APIs
- Record
GHSA-h8fp-f39c-q6mh- CVSS 3.1
- 6.9 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:L/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
NVD
React Router is a router for React. In versions 7.11.0 through 7.17.0, the RSCErrorHandler is missing protocol validation, allowing for redirects from untrusted sources. This issue is a follow up to CVE-2026-53667, and only affects consuming applications if they are using the unstable RSC APIs. This issue has been fixed in version 7.18.0.
- Record
CVE-2026-53667- CVSS 3.1
- 6.9 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:L/A:N - CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
OSV
React Router: Cross-site Scripting is Possible due to Missing RSCErrorHandler Protocol Validation (Incomplete fix for CVE-2026-53667)
React Router is a router for React. In versions 7.11.0 through 7.17.0, the RSCErrorHandler is missing protocol validation, allowing for redirects from untrusted sources. This issue is a follow up to CVE-2026-53667, and only affects consuming applications if they are using the unstable RSC APIs. This issue has been fixed in version 7.18.0.
- Record
CVE-2026-53667- CVSS 3.1
- 6.9 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:L/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
OSVGHSA-h8fp-f39c-q6mh
React Router: RSCErrorHandler Missing Protocol Validation (XSS)
This is a follow up to https://github.com/remix-run/react-router/security/advisories/GHSA-8646-j5j9-6r62. React Router was alerted of a code path in the (unstable) RSC error handling path in which redirects from untrusted sources could still result in an XSS vector via attacker-supplied redirect targets
[!NOTE] This only affects your application if you are using the unstable RSC APIs
- Record
GHSA-h8fp-f39c-q6mh- CVSS 3.1
- 6.9 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:L/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
Show 7 moreShow less
OSVCLSA-2026-1791465168 No score
TuxCare security update for react-router (4 CVEs)
TuxCare rebuilt react-router to address 4 CVEs. Fixed in 7.15.0-tuxcare.1.
- Record
CLSA-2026-1791465168- Updated
- 2026-11-02
OSVCLSA-2026-1792191744 No score
TuxCare security update for react-router (4 CVEs)
TuxCare rebuilt react-router to address 4 CVEs. Fixed in 7.14.2-tuxcare.1.
- Record
CLSA-2026-1792191744- Updated
- 2026-11-02
OSVCLSA-2026-1792253402 No score
TuxCare security update for react-router-dom (4 CVEs)
TuxCare rebuilt react-router-dom to address 4 CVEs. Fixed in 7.15.0-tuxcare.1.
- Record
CLSA-2026-1792253402- Updated
- 2026-11-02
OSVCLSA-2026-1792253416 No score
TuxCare security update for react-router-dom (4 CVEs)
TuxCare rebuilt react-router-dom to address 4 CVEs. Fixed in 7.14.2-tuxcare.1.
- Record
CLSA-2026-1792253416- Updated
- 2026-11-02
OSVCLSA-2026-1793102180 No score
TuxCare security update for react-router (5 CVEs)
TuxCare rebuilt react-router to address 5 CVEs. Fixed in 7.13.1-tuxcare.2.
- Record
CLSA-2026-1793102180- Updated
- 2026-11-06
OSVCLSA-2026-1793810913 No score
TuxCare security update for react-router (2 CVEs)
TuxCare rebuilt react-router to address 2 CVEs. Fixed in 7.14.1-tuxcare.4.
- Record
CLSA-2026-1793810913- Updated
- 2026-11-04
OSVROOT-APP-NPM-CVE-2026-53667 No score
CVE-2026-53667 in react-router - Patched by Root
Root has patched CVE-2026-53667 in the react-router package for Root:npm. Multiple fixed versions available.
- Record
ROOT-APP-NPM-CVE-2026-53667- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
react-routernpm |
7.11.0 up to 7.18.0 | 7.18.0 |
react-routerTuxCare:npm From an advisory covering 4 CVEs |
7.15.0-tuxcare.0 up to 7.15.0-tuxcare.1, plus listed versions 7.15.0 |
7.15.0-tuxcare.1 |
react-routerTuxCare:npm From an advisory covering 4 CVEs |
7.14.2-tuxcare.0 up to 7.14.2-tuxcare.1, plus listed versions 7.14.2 |
7.14.2-tuxcare.1 |
react-router-domTuxCare:npm From an advisory covering 4 CVEs |
7.15.0-tuxcare.0 up to 7.15.0-tuxcare.1, plus listed versions 7.15.0 |
7.15.0-tuxcare.1 |
react-router-domTuxCare:npm From an advisory covering 4 CVEs |
7.14.2-tuxcare.0 up to 7.14.2-tuxcare.1, plus listed versions 7.14.2 |
7.14.2-tuxcare.1 |
react-routerTuxCare:npm From an advisory covering 5 CVEs |
7.13.1-tuxcare.0 up to 7.13.1-tuxcare.2, plus listed versions 7.13.17.13.1-tuxcare.1 |
7.13.1-tuxcare.2 |
react-routerTuxCare:npm From an advisory covering 2 CVEs |
7.14.1-tuxcare.0 up to 7.14.1-tuxcare.4, plus listed versions 7.14.17.14.1-tuxcare.17.14.1-tuxcare.27.14.1-tuxcare.3 |
7.14.1-tuxcare.4 |
react-routerRoot:npm |
before 7.18.0-aikido.1 | 7.18.0-aikido.1 |
@rootio/react-routerRoot:npm |
before 7.18.0-root.io.1 | 7.18.0-root.io.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected | OSV | |
| affected | ||
| affected, aliases, facts | OSV | |
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-53667 is a medium vulnerability (CVSS 6.9) in @tanstack React-router, published July 23, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.36%, the 29th percentile. Fixed in react-router 7.18.0.
References
github.com/remix-run/react-router/security/advisories/GHSA-h8fp-f39c-q6mh
nvd.nist.gov/vuln/detail/CVE-2026-53667