Every CVE Search/ Get API key

CVE-2026-55685

React Router: Unauthenticated Denial of Service via Inefficient Route Matching

8.7 HighFix available

React Router is a router for React. In versions 7.0.0 through 7.17.0, the manifest endpoint could be accessed via unauthenticated targeted requests that would put heavy load on the server and slow down response times. This issue is a follow up to CVE-2026-42342, and does not does not impact React Router applications using Declarative Mode (<BrowserRouter>) or Data Mode (createBrowserRouter/<RouterProvider>). This issue has been fixed in version 7.18.0.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
None
Integrity
None
Availability
High

Exploit likelihood

0.71%Up 0.1 points since Jul 28, 2026
90%50%10%1%

What each source reports

CVE List Score used 8.7

React Router: Unauthenticated Denial of Service via Inefficient Route Matching

React Router is a router for React. In versions 7.0.0 through 7.17.0, the manifest endpoint could be accessed via unauthenticated targeted requests that would put heavy load on the server and slow down response times. This issue is a follow up to CVE-2026-42342, and does not does not impact React Router applications using Declarative Mode (<BrowserRouter>) or Data Mode (createBrowserRouter/<RouterProvider>). This issue has been fixed in version 7.18.0.

Record
CVE-2026-55685
CVSS 4.0
8.7 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Weakness
CWE-400, CWE-407
Updated
2026-11-02
EUVDEUVD-2026-49634 8.7

React Router is a router for React. In versions 7.0.0 through 7.17.0, the manifest endpoint could be accessed via unauthenticated targeted requests that would put heavy load on the server and slow down response times. This issue is a follow up to CVE-2026-42342, and does not does not impact React Router applications using Declarative Mode (<BrowserRouter>) or Data Mode (createBrowserRouter/<RouterProvider>). This issue has been fixed in version 7.18.0.

Record
EUVD-2026-49634
CVSS 4.0
8.7 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Updated
2026-11-02
GitHub AdvisoriesGHSA-chx6-hx7r-mcp5 8.7

React Router: Unauthenticated Denial of Service via Inefficient Route Matching

This is a follow up to https://github.com/remix-run/react-router/security/advisories/GHSA-8x6r-g9mw-2r78 that covers additional reported scenarios in which the manifest endpoint could be accessed via unauthenticated targeted requests that would put heavy load on the server and slow down response times.

[!NOTE] This only impacts Framework Mode applications. This does not impact your application if you are using Declarative or Data Mode.

Record
GHSA-chx6-hx7r-mcp5
CVSS 4.0
8.7 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Weakness
CWE-400, CWE-407
Updated
2026-11-02
GitHub AdvisoriesGHSA-qwww-vcr4-c8h2 7.1

React Router: RSC Mode CSRF Bypass Allows Action Execution Before 400 Response

This is a follow up to CVE-2026-22030 to address related CSRF flows in unstable RSC code paths.

[!NOTE] This only affects your application if you are using the unstable RSC APIs

Record
GHSA-qwww-vcr4-c8h2
CVSS 4.0
7.1 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
Weakness
CWE-352
Updated
2026-11-02
NVD 8.7

React Router is a router for React. In versions 7.0.0 through 7.17.0, the manifest endpoint could be accessed via unauthenticated targeted requests that would put heavy load on the server and slow down response times. This issue is a follow up to CVE-2026-42342, and does not does not impact React Router applications using Declarative Mode (<BrowserRouter>) or Data Mode (createBrowserRouter/<RouterProvider>). This issue has been fixed in version 7.18.0.

Record
CVE-2026-55685
CVSS 4.0
8.7 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-400, CWE-407
Updated
2026-11-02
OSV 8.7

React Router: Unauthenticated Denial of Service via Inefficient Route Matching

React Router is a router for React. In versions 7.0.0 through 7.17.0, the manifest endpoint could be accessed via unauthenticated targeted requests that would put heavy load on the server and slow down response times. This issue is a follow up to CVE-2026-42342, and does not does not impact React Router applications using Declarative Mode (<BrowserRouter>) or Data Mode (createBrowserRouter/<RouterProvider>). This issue has been fixed in version 7.18.0.

Record
CVE-2026-55685
CVSS 4.0
8.7 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Weakness
CWE-400, CWE-407
Updated
2026-11-02
Show 31 moreShow less
OSVGHSA-chx6-hx7r-mcp5 8.7

React Router: Unauthenticated Denial of Service via Inefficient Route Matching

This is a follow up to https://github.com/remix-run/react-router/security/advisories/GHSA-8x6r-g9mw-2r78 that covers additional reported scenarios in which the manifest endpoint could be accessed via unauthenticated targeted requests that would put heavy load on the server and slow down response times.

[!NOTE] This only impacts Framework Mode applications. This does not impact your application if you are using Declarative or Data Mode.

Record
GHSA-chx6-hx7r-mcp5
CVSS 4.0
8.7 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Weakness
CWE-400, CWE-407
Updated
2026-11-02
OSVGHSA-qwww-vcr4-c8h2 7.1

React Router: RSC Mode CSRF Bypass Allows Action Execution Before 400 Response

This is a follow up to CVE-2026-22030 to address related CSRF flows in unstable RSC code paths.

[!NOTE] This only affects your application if you are using the unstable RSC APIs

Record
GHSA-qwww-vcr4-c8h2
CVSS 4.0
7.1 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
Weakness
CWE-352
Updated
2026-11-02
OSVCLSA-2026-1784856417 No score

TuxCare security update for 2 packages (1 CVE)

TuxCare rebuilt 2 packages to address 1 CVE. Fixed in 7.5.1-tuxcare.7.

Record
CLSA-2026-1784856417
Updated
2026-11-02
OSVCLSA-2026-1791052929 No score

TuxCare security update for react-router (1 CVE)

TuxCare rebuilt react-router to address 1 CVE. Fixed in 7.18.1-tuxcare.1.

Record
CLSA-2026-1791052929
Updated
2026-11-02
OSVCLSA-2026-1792139276 No score

TuxCare security update for react-router (2 CVEs)

TuxCare rebuilt react-router to address 2 CVEs. Fixed in 7.15.0-tuxcare.2.

Record
CLSA-2026-1792139276
Updated
2026-11-02
OSVCLSA-2026-1792253398 No score

TuxCare security update for react-router-dom (1 CVE)

TuxCare rebuilt react-router-dom to address 1 CVE. Fixed in 7.5.1-tuxcare.7.

Record
CLSA-2026-1792253398
Updated
2026-11-02
OSVCLSA-2026-1792253413 No score

TuxCare security update for react-router-dom (1 CVE)

TuxCare rebuilt react-router-dom to address 1 CVE. Fixed in 7.18.1-tuxcare.1.

Record
CLSA-2026-1792253413
Updated
2026-11-02
OSVCLSA-2026-1792253415 No score

TuxCare security update for react-router-dom (2 CVEs)

TuxCare rebuilt react-router-dom to address 2 CVEs. Fixed in 7.15.0-tuxcare.2.

Record
CLSA-2026-1792253415
Updated
2026-11-02
OSVCLSA-2026-1792419113 No score

TuxCare security update for @react-router/architect (1 CVE)

TuxCare rebuilt @react-router/architect to address 1 CVE. Fixed in 7.5.1-tuxcare.7.

Record
CLSA-2026-1792419113
Updated
2026-11-02
OSVCLSA-2026-1792419118 No score

TuxCare security update for @react-router/architect (1 CVE)

TuxCare rebuilt @react-router/architect to address 1 CVE. Fixed in 7.18.1-tuxcare.1.

Record
CLSA-2026-1792419118
Updated
2026-11-02
OSVCLSA-2026-1792419191 No score

TuxCare security update for @react-router/cloudflare (1 CVE)

TuxCare rebuilt @react-router/cloudflare to address 1 CVE. Fixed in 7.5.1-tuxcare.7.

Record
CLSA-2026-1792419191
Updated
2026-11-02
OSVCLSA-2026-1792419194 No score

TuxCare security update for @react-router/cloudflare (1 CVE)

TuxCare rebuilt @react-router/cloudflare to address 1 CVE. Fixed in 7.18.1-tuxcare.1.

Record
CLSA-2026-1792419194
Updated
2026-11-02
OSVCLSA-2026-1792419269 No score

TuxCare security update for @react-router/express (1 CVE)

TuxCare rebuilt @react-router/express to address 1 CVE. Fixed in 7.5.1-tuxcare.7.

Record
CLSA-2026-1792419269
Updated
2026-11-02
OSVCLSA-2026-1792419273 No score

TuxCare security update for @react-router/express (1 CVE)

TuxCare rebuilt @react-router/express to address 1 CVE. Fixed in 7.18.1-tuxcare.1.

Record
CLSA-2026-1792419273
Updated
2026-11-02
OSVCLSA-2026-1792419625 No score

TuxCare security update for @react-router/node (1 CVE)

TuxCare rebuilt @react-router/node to address 1 CVE. Fixed in 7.5.1-tuxcare.7.

Record
CLSA-2026-1792419625
Updated
2026-11-02
OSVCLSA-2026-1792419628 No score

TuxCare security update for @react-router/node (1 CVE)

TuxCare rebuilt @react-router/node to address 1 CVE. Fixed in 7.18.1-tuxcare.1.

Record
CLSA-2026-1792419628
Updated
2026-11-02
OSVCLSA-2026-1792421943 No score

TuxCare security update for @react-router/remix-routes-option-adapter (1 CVE)

TuxCare rebuilt @react-router/remix-routes-option-adapter to address 1 CVE. Fixed in 7.5.1-tuxcare.7.

Record
CLSA-2026-1792421943
Updated
2026-11-02
OSVCLSA-2026-1792421948 No score

TuxCare security update for @react-router/remix-routes-option-adapter (1 CVE)

TuxCare rebuilt @react-router/remix-routes-option-adapter to address 1 CVE. Fixed in 7.18.1-tuxcare.1.

Record
CLSA-2026-1792421948
Updated
2026-11-02
OSVCLSA-2026-1792424732 No score

TuxCare security update for @react-router/dev (1 CVE)

TuxCare rebuilt @react-router/dev to address 1 CVE. Fixed in 7.5.1-tuxcare.7.

Record
CLSA-2026-1792424732
Updated
2026-11-02
OSVCLSA-2026-1792424737 No score

TuxCare security update for @react-router/dev (1 CVE)

TuxCare rebuilt @react-router/dev to address 1 CVE. Fixed in 7.18.1-tuxcare.1.

Record
CLSA-2026-1792424737
Updated
2026-11-02
OSVCLSA-2026-1792425407 No score

TuxCare security update for @react-router/fs-routes (1 CVE)

TuxCare rebuilt @react-router/fs-routes to address 1 CVE. Fixed in 7.5.1-tuxcare.7.

Record
CLSA-2026-1792425407
Updated
2026-11-02
OSVCLSA-2026-1792425410 No score

TuxCare security update for @react-router/fs-routes (1 CVE)

TuxCare rebuilt @react-router/fs-routes to address 1 CVE. Fixed in 7.18.1-tuxcare.1.

Record
CLSA-2026-1792425410
Updated
2026-11-02
OSVCLSA-2026-1792428108 No score

TuxCare security update for @react-router/serve (1 CVE)

TuxCare rebuilt @react-router/serve to address 1 CVE. Fixed in 7.5.1-tuxcare.7.

Record
CLSA-2026-1792428108
Updated
2026-11-02
OSVCLSA-2026-1792428114 No score

TuxCare security update for @react-router/serve (1 CVE)

TuxCare rebuilt @react-router/serve to address 1 CVE. Fixed in 7.18.1-tuxcare.1.

Record
CLSA-2026-1792428114
Updated
2026-11-02
OSVCLSA-2026-1792430032 No score

TuxCare security update for create-react-router (1 CVE)

TuxCare rebuilt create-react-router to address 1 CVE. Fixed in 7.5.1-tuxcare.7.

Record
CLSA-2026-1792430032
Updated
2026-11-02
OSVCLSA-2026-1792430036 No score

TuxCare security update for create-react-router (1 CVE)

TuxCare rebuilt create-react-router to address 1 CVE. Fixed in 7.18.1-tuxcare.1.

Record
CLSA-2026-1792430036
Updated
2026-11-02
OSVCLSA-2026-1793099986 No score

TuxCare security update for react-router (3 CVEs)

TuxCare rebuilt react-router to address 3 CVEs. Fixed in 7.14.1-tuxcare.2.

Record
CLSA-2026-1793099986
Updated
2026-11-06
OSVCLSA-2026-1793110184 No score

TuxCare security update for react-router (1 CVE)

TuxCare rebuilt react-router to address 1 CVE. Fixed in 7.14.2-tuxcare.2.

Record
CLSA-2026-1793110184
Updated
2026-11-06
OSVCLSA-2026-1793125641 No score

TuxCare security update for react-router (1 CVE)

TuxCare rebuilt react-router to address 1 CVE. Fixed in 7.13.1-tuxcare.3.

Record
CLSA-2026-1793125641
Updated
2026-11-02
OSVROOT-APP-NPM-CVE-2026-55685 No score

CVE-2026-55685 in react-router - Patched by Root

Root has patched CVE-2026-55685 in the react-router package for Root:npm. Multiple fixed versions available.

Record
ROOT-APP-NPM-CVE-2026-55685
Updated
2026-11-02
OSVROOT-APP-NPM-GHSA-qwww-vcr4-c8h2 No score

GHSA-qwww-vcr4-c8h2 in react-router - Patched by Root

Root has patched GHSA-qwww-vcr4-c8h2 in the react-router package for Root:npm. Multiple fixed versions available.

Record
ROOT-APP-NPM-GHSA-qwww-vcr4-c8h2
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
react-router
npm
 7.0.0 up to 7.18.0
7.18.0
react-router
npm
 7.12.0 up to 7.18.2
7.18.2
react-router
npm
 8.0.0 up to 8.3.0
8.3.0
react-router
TuxCare:npm
 7.5.1-tuxcare.0 up to 7.5.1-tuxcare.7, plus listed versions
7.5.17.5.1-tuxcare.17.5.1-tuxcare.27.5.1-tuxcare.37.5.1-tuxcare.47.5.1-tuxcare.57.5.1-tuxcare.6
7.5.1-tuxcare.7
react-router-dev
TuxCare:npm
 7.5.1-tuxcare.0 up to 7.5.1-tuxcare.7, plus listed versions
7.5.17.5.1-tuxcare.17.5.1-tuxcare.27.5.1-tuxcare.37.5.1-tuxcare.47.5.1-tuxcare.57.5.1-tuxcare.6
7.5.1-tuxcare.7
react-router
TuxCare:npm
 7.18.1-tuxcare.0 up to 7.18.1-tuxcare.1, plus listed versions
7.18.1
7.18.1-tuxcare.1
react-router
TuxCare:npm
 7.15.0-tuxcare.0 up to 7.15.0-tuxcare.2, plus listed versions
7.15.07.15.0-tuxcare.1
7.15.0-tuxcare.2
react-router-dom
TuxCare:npm
 7.5.1-tuxcare.0 up to 7.5.1-tuxcare.7, plus listed versions
7.5.17.5.1-tuxcare.17.5.1-tuxcare.47.5.1-tuxcare.57.5.1-tuxcare.6
7.5.1-tuxcare.7
react-router-dom
TuxCare:npm
 7.18.1-tuxcare.0 up to 7.18.1-tuxcare.1, plus listed versions
7.18.1
7.18.1-tuxcare.1
react-router-dom
TuxCare:npm
 7.15.0-tuxcare.0 up to 7.15.0-tuxcare.2, plus listed versions
7.15.07.15.0-tuxcare.1
7.15.0-tuxcare.2
Show 25 moreShow less
Affected packages
PackageAffectedFixed
@react-router/architect
TuxCare:npm
 7.5.1-tuxcare.0 up to 7.5.1-tuxcare.7, plus listed versions
7.5.17.5.1-tuxcare.17.5.1-tuxcare.47.5.1-tuxcare.57.5.1-tuxcare.6
7.5.1-tuxcare.7
@react-router/architect
TuxCare:npm
 7.18.1-tuxcare.0 up to 7.18.1-tuxcare.1, plus listed versions
7.18.1
7.18.1-tuxcare.1
@react-router/cloudflare
TuxCare:npm
 7.5.1-tuxcare.0 up to 7.5.1-tuxcare.7, plus listed versions
7.5.17.5.1-tuxcare.17.5.1-tuxcare.47.5.1-tuxcare.57.5.1-tuxcare.6
7.5.1-tuxcare.7
@react-router/cloudflare
TuxCare:npm
 7.18.1-tuxcare.0 up to 7.18.1-tuxcare.1, plus listed versions
7.18.1
7.18.1-tuxcare.1
@react-router/express
TuxCare:npm
 7.5.1-tuxcare.0 up to 7.5.1-tuxcare.7, plus listed versions
7.5.17.5.1-tuxcare.17.5.1-tuxcare.47.5.1-tuxcare.57.5.1-tuxcare.6
7.5.1-tuxcare.7
@react-router/express
TuxCare:npm
 7.18.1-tuxcare.0 up to 7.18.1-tuxcare.1, plus listed versions
7.18.1
7.18.1-tuxcare.1
@react-router/node
TuxCare:npm
 7.5.1-tuxcare.0 up to 7.5.1-tuxcare.7, plus listed versions
7.5.17.5.1-tuxcare.17.5.1-tuxcare.47.5.1-tuxcare.57.5.1-tuxcare.6
7.5.1-tuxcare.7
@react-router/node
TuxCare:npm
 7.18.1-tuxcare.0 up to 7.18.1-tuxcare.1, plus listed versions
7.18.1
7.18.1-tuxcare.1
@react-router/remix-routes-option-adapter
TuxCare:npm
 7.5.1-tuxcare.0 up to 7.5.1-tuxcare.7, plus listed versions
7.5.17.5.1-tuxcare.17.5.1-tuxcare.47.5.1-tuxcare.57.5.1-tuxcare.6
7.5.1-tuxcare.7
@react-router/remix-routes-option-adapter
TuxCare:npm
 7.18.1-tuxcare.0 up to 7.18.1-tuxcare.1, plus listed versions
7.18.1
7.18.1-tuxcare.1
@react-router/dev
TuxCare:npm
 7.5.1-tuxcare.0 up to 7.5.1-tuxcare.7, plus listed versions
7.5.17.5.1-tuxcare.17.5.1-tuxcare.47.5.1-tuxcare.57.5.1-tuxcare.6
7.5.1-tuxcare.7
@react-router/dev
TuxCare:npm
 7.18.1-tuxcare.0 up to 7.18.1-tuxcare.1, plus listed versions
7.18.1
7.18.1-tuxcare.1
@react-router/fs-routes
TuxCare:npm
 7.5.1-tuxcare.0 up to 7.5.1-tuxcare.7, plus listed versions
7.5.17.5.1-tuxcare.17.5.1-tuxcare.47.5.1-tuxcare.57.5.1-tuxcare.6
7.5.1-tuxcare.7
@react-router/fs-routes
TuxCare:npm
 7.18.1-tuxcare.0 up to 7.18.1-tuxcare.1, plus listed versions
7.18.1
7.18.1-tuxcare.1
@react-router/serve
TuxCare:npm
 7.5.1-tuxcare.0 up to 7.5.1-tuxcare.7, plus listed versions
7.5.17.5.1-tuxcare.17.5.1-tuxcare.47.5.1-tuxcare.57.5.1-tuxcare.6
7.5.1-tuxcare.7
@react-router/serve
TuxCare:npm
 7.18.1-tuxcare.0 up to 7.18.1-tuxcare.1, plus listed versions
7.18.1
7.18.1-tuxcare.1
create-react-router
TuxCare:npm
 7.5.1-tuxcare.0 up to 7.5.1-tuxcare.7, plus listed versions
7.5.17.5.1-tuxcare.17.5.1-tuxcare.47.5.1-tuxcare.57.5.1-tuxcare.6
7.5.1-tuxcare.7
create-react-router
TuxCare:npm
 7.18.1-tuxcare.0 up to 7.18.1-tuxcare.1, plus listed versions
7.18.1
7.18.1-tuxcare.1
react-router
TuxCare:npm
From an advisory covering 2 CVEs
 7.14.1-tuxcare.0 up to 7.14.1-tuxcare.2, plus listed versions
7.14.17.14.1-tuxcare.1
7.14.1-tuxcare.2
react-router
TuxCare:npm
 7.14.2-tuxcare.0 up to 7.14.2-tuxcare.2, plus listed versions
7.14.27.14.2-tuxcare.1
7.14.2-tuxcare.2
react-router
TuxCare:npm
 7.13.1-tuxcare.0 up to 7.13.1-tuxcare.3, plus listed versions
7.13.17.13.1-tuxcare.17.13.1-tuxcare.2
7.13.1-tuxcare.3
react-router
Root:npm
 before 7.15.1-aikido.1
7.15.1-aikido.17.12.0-aikido.37.15.1-aikido.37.18.0-aikido.1
@rootio/react-router
Root:npm
 before 7.15.1-root.io.1
7.15.1-root.io.17.12.0-root.io.37.15.1-root.io.37.18.0-root.io.1
react-router
Root:npm
 before 7.12.0-aikido.3
7.12.0-aikido.37.15.1-aikido.37.18.0-aikido.1
@rootio/react-router
Root:npm
 before 7.12.0-root.io.3
7.12.0-root.io.37.15.1-root.io.37.18.0-root.io.1

History

History
RecordedChangedSources
affected, aliasesOSV
affected, facts
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-55685 is a high vulnerability (CVSS 8.7) in @tanstack React-router, published July 24, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.71%, the 53rd percentile. Fixed in react-router 7.18.0.

References

Show 13 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open