Every CVE Search/ Get API key

CVE-2026-33244

React Router has stored XSS via unescaped Location header in prerendered redirect HTML

5.4 MediumFix available

React Router is a router for React. In versions 7.5.1 through 7.13.1, when using Framework Mode with pre-rendering enabled, improper neutralization of the HTTP Location header value can permit Cross-Site Scripting (XSS) in the statically generated HTML files if the redirect location comes from an untrusted source. This does not impact applications using Declarative Mode (<BrowserRouter>) or Data Mode (createBrowserRouter/<RouterProvider>). This is patched in version 7.13.2.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
Low
User interaction
Required

What an attacker can affect

Confidentiality
Low
Integrity
Low
Availability
None

Exploit likelihood

0.14%Up 0.1 points since Jun 3, 2026
90%50%10%1%

What each source reports

CVE List Score used 5.4

React Router has stored XSS via unescaped Location header in prerendered redirect HTML

React Router is a router for React. In versions 7.5.1 through 7.13.1, when using Framework Mode with pre-rendering enabled, improper neutralization of the HTTP Location header value can permit Cross-Site Scripting (XSS) in the statically generated HTML files if the redirect location comes from an untrusted source. This does not impact applications using Declarative Mode (<BrowserRouter>) or Data Mode (createBrowserRouter/<RouterProvider>). This is patched in version 7.13.2.

Record
CVE-2026-33244
CVSS 3.1
5.4 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Weakness
CWE-79
Updated
2026-11-02
EUVDEUVD-2026-33986 5.4

React Router is a router for React. In versions 7.5.1 through 7.13.1, when using Framework Mode with pre-rendering enabled, improper neutralization of the HTTP Location header value can permit Cross-Site Scripting (XSS) in the statically generated HTML files if the redirect location comes from an untrusted source. This does not impact applications using Declarative Mode (<BrowserRouter>) or Data Mode (createBrowserRouter/<RouterProvider>). This is patched in version 7.13.2.

Record
EUVD-2026-33986
CVSS 3.1
5.4 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Updated
2026-11-02
GitHub AdvisoriesGHSA-f22v-gfqf-p8f3 5.4

React Router has stored XSS via unescaped Location header in prerendered redirect HTML

When using React Router v7 Framework Mode with Pre-rendering enabled, an improper neutralization of the HTTP Location header value can permit Cross-Site Scripting (XSS) in statically generated HTML files if the redirect location comes from an untrusted source.

[!NOTE] This does not impact your React Router application if you are using Declarative Mode (<BrowserRouter>) or Data Mode (createBrowserRouter/<RouterProvider>).

Record
GHSA-f22v-gfqf-p8f3
CVSS 3.1
5.4 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Weakness
CWE-79
Updated
2026-11-02
NVD 5.4

React Router is a router for React. In versions 7.5.1 through 7.13.1, when using Framework Mode with pre-rendering enabled, improper neutralization of the HTTP Location header value can permit Cross-Site Scripting (XSS) in the statically generated HTML files if the redirect location comes from an untrusted source. This does not impact applications using Declarative Mode (<BrowserRouter>) or Data Mode (createBrowserRouter/<RouterProvider>). This is patched in version 7.13.2.

Record
CVE-2026-33244
CVSS 3.1
5.4 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Weakness
CWE-79
Updated
2026-11-02
OSV 5.4

React Router has stored XSS via unescaped Location header in prerendered redirect HTML

React Router is a router for React. In versions 7.5.1 through 7.13.1, when using Framework Mode with pre-rendering enabled, improper neutralization of the HTTP Location header value can permit Cross-Site Scripting (XSS) in the statically generated HTML files if the redirect location comes from an untrusted source. This does not impact applications using Declarative Mode (<BrowserRouter>) or Data Mode (createBrowserRouter/<RouterProvider>). This is patched in version 7.13.2.

Record
CVE-2026-33244
CVSS 3.1
5.4 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Weakness
CWE-79
Updated
2026-11-02
OSVGHSA-f22v-gfqf-p8f3 5.4

React Router has stored XSS via unescaped Location header in prerendered redirect HTML

When using React Router v7 Framework Mode with Pre-rendering enabled, an improper neutralization of the HTTP Location header value can permit Cross-Site Scripting (XSS) in statically generated HTML files if the redirect location comes from an untrusted source.

[!NOTE] This does not impact your React Router application if you are using Declarative Mode (<BrowserRouter>) or Data Mode (createBrowserRouter/<RouterProvider>).

Record
GHSA-f22v-gfqf-p8f3
CVSS 3.1
5.4 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Weakness
CWE-79
Updated
2026-11-02
Show 9 moreShow less
OSVCLSA-2026-1788960805 No score

TuxCare security update for 2 packages (3 CVEs)

TuxCare rebuilt 2 packages to address 3 CVEs. Fixed in 7.5.1-tuxcare.10.

Record
CLSA-2026-1788960805
Updated
2026-11-02
OSVCLSA-2026-1792419115 No score

TuxCare security update for @react-router/architect (3 CVEs)

TuxCare rebuilt @react-router/architect to address 3 CVEs. Fixed in 7.5.1-tuxcare.10.

Record
CLSA-2026-1792419115
Updated
2026-11-02
OSVCLSA-2026-1792419193 No score

TuxCare security update for @react-router/cloudflare (3 CVEs)

TuxCare rebuilt @react-router/cloudflare to address 3 CVEs. Fixed in 7.5.1-tuxcare.10.

Record
CLSA-2026-1792419193
Updated
2026-11-02
OSVCLSA-2026-1792421947 No score

TuxCare security update for @react-router/remix-routes-option-adapter (3 CVEs)

TuxCare rebuilt @react-router/remix-routes-option-adapter to address 3 CVEs. Fixed in 7.5.1-tuxcare.10.

Record
CLSA-2026-1792421947
Updated
2026-11-02
OSVCLSA-2026-1792425411 No score

TuxCare security update for @react-router/fs-routes (3 CVEs)

TuxCare rebuilt @react-router/fs-routes to address 3 CVEs. Fixed in 7.5.1-tuxcare.10.

Record
CLSA-2026-1792425411
Updated
2026-11-02
OSVCLSA-2026-1792430035 No score

TuxCare security update for create-react-router (3 CVEs)

TuxCare rebuilt create-react-router to address 3 CVEs. Fixed in 7.5.1-tuxcare.10.

Record
CLSA-2026-1792430035
Updated
2026-11-02
OSVCLSA-2026-1793811163 No score

TuxCare security update for react-router (2 CVEs)

TuxCare rebuilt react-router to address 2 CVEs. Fixed in 7.13.1-tuxcare.4.

Record
CLSA-2026-1793811163
Updated
2026-11-04
OSVSUSE-SU-2026:3713-1 No score

Security update for Multi-Linux Manager Client Tools - Monitoring stack

This update fixes the following issues:

golang-github-prometheus-alertmanager:

  • CVE-2026-39821: Fix validation bypass and privilege escalation by updating golang.org/x/net to version 0.55.0 (bsc#1266615)

golang-github-prometheus-prometheus updated from version 3.5.3 to 3.5.4:

  • Security fixes:

    • CVE-2026-39882: Fix reading unbounded HTTP response bodies by bumping OpenTelemetry to 1.43.0 (bsc#1274221)
    • CVE-2026-33244: Fix improper neutralization of the HTTP Location header value in react-router (bsc#1267416)
    • CVE-2026-13149: Prevent potential DoS by bumping brace-expansion to version 5.0.7 (bsc#1269917)
    • CVE-2026-33814: Fix infinite loop in HTTP/2 transport (bsc#1265827)

  • Other bugs fixed and changes:

    • STACKIT SD: Fix secrets being exposed in plaintext via /-/config endpoint
    • Chore: Bump golang.org/x/net to version 0.55.0

grafana updated from version 11.6.14+security04 to version 12.4.5:

Security fixes:

  • CVE-2026-39882: Prevent memory exhaustion DoS in OpenTelemetry OTLP HTTP exporters (bsc#1274217)
  • CVE-2026-33382: Limit the size of the request body before processing it at several Grafana API endpoints (bsc#1271331)
  • CVE-2025-12141: Fixed information leakage in Grafana Alerting (bsc#1262187)
  • CVE-2026-41607: Fix potential information disclosure in Apache Thrift (bsc#1263272)

Breaking chahnges introduced in version 12.0.0:

  • BREAKING: Removed AngularJS and all deprecated UI Extensions APIs.
  • BREAKING: Enforced stricter version compatibility checks in plugin CLI install commands.
  • BREAKING: Enabled the failWrongDSUID feature flag by default, which rejects data sources with incorrect UIDs.

Other changes introduced from version 11.6.14+security04 to version 12.4.5 (jsc#PED-16512):

  • Add Legal-Review-Notice (bsc#1271327)
  • Datasources: return 400 when payload UID does not match URL UID in PUT /api/datasources/uid/:uid
  • Analytics: Keep internal dashboard id.
  • Reporting: Correctly apply appSubURL to report settings requests
  • Alerting: Document Grafana HA Alertmanager cluster metrics prefix change.
  • Dependency updates to core plugins and UI libraries.
  • Updates to data source provisioning and dashboard schemas.
  • Introduced dynamic dashboards in public preview.
  • Added a new side toolbar that replaces the second top toolbar to provide additional vertical space.
  • Added the ability to create dashboards from templates using sample data.
  • Revamped the gauge visualization with rounded bars, configurable bar thickness, and endpoint markers.
  • Added support to map one variable to multiple values.
  • Released a completely redesigned logs visualization.
  • Added the ability to export dashboards directly as PNG images.
  • Introduced an interactive learning experience within the Grafana UI.
  • Added a Switch template variable type to quickly toggle between values in queries.
  • Added functionality to style table cells using CSS properties via the field cell option.
  • Added support for Entra Workload Identity to enhance authentication capabilities with federated credentials.
  • Redesigned the alert rule list page.
  • Renamed Mute Timings to Active Time Intervals in Grafana Alerting.
  • Added support for Service Account Impersonation in the BigQuery data source.
  • Introduced the Grafana Advisor in public preview.
  • Introduced a new dashboard schema to replace the original single grid layout.
  • MIGRATION: Triggered a full-table rewrite for the annotation table, which may temporarily increase disk usage.
Record
SUSE-SU-2026:3713-1
Updated
2026-11-02
OSVSUSE-SU-2026:3714-1 No score

Security update for Multi-Linux Manager Monitoring stack

This update fixes the following issues:

prometheus-postgres_exporter:

  • CVE-2022-21698: Replace github.com/prometheus/client_golang with version 1.11.1 and prevent validation bypass and privilege escalation (bsc#1248699)

golang-github-prometheus-alertmanager:

  • CVE-2026-39821: Fix validation bypass and privilege escalation by updating golang.org/x/net to version 0.55.0 (bsc#1266615)

golang-github-prometheus-prometheus was updated from version 3.5.3 to 3.5.4:

Security fixes:

  • CVE-2026-39882: Fix reading unbounded HTTP response bodies by bumping OpenTelemetry to 1.43.0 (bsc#1274221)
  • CVE-2026-33244: Fixed improper neutralization of the HTTP Location header value in react-router (bsc#1267416)
  • CVE-2026-13149: Prevent potential DoS by bumping brace-expansion to version 5.0.7 (bsc#1269917)
  • CVE-2026-33814: Fixed infinite loop in HTTP/2 transport (bsc#1265827)

Other changes and fixes:

  • STACKIT SD: Fixed secrets being exposed in plaintext via /-/config endpoint
  • Chore: Bump golang.org/x/net to version 0.55.0

grafana updated from version 11.6.14+security04 to version 12.4.5:

Security fixes:

  • CVE-2026-33382: Limit the size of the request body before processing it at several Grafana API endpoints (bsc#1271331)
  • CVE-2026-39882: Prevent memory exhaustion DoS in OpenTelemetry OTLP HTTP exporters (bsc#1274217)
  • CVE-2025-12141: Fixed information leakage in Grafana Alerting (bsc#1262187)
  • CVE-2026-41607: Fix potential information disclosure in Apache Thrift (bsc#1263272)

Breaking chahnges introduced in version 12.0.0:

  • BREAKING: Removed AngularJS and all deprecated UI Extensions APIs.
  • BREAKING: Enforced stricter version compatibility checks in plugin CLI install commands.
  • BREAKING: Enabled the failWrongDSUID feature flag by default, which rejects data sources with incorrect UIDs.

Other changes introduced from version 11.6.14+security04 to version 12.4.5 (jsc#PED-16512):

  • Add Legal-Review-Notice (bsc#1271327)
  • Datasources: return 400 when payload UID does not match URL UID in PUT /api/datasources/uid/:uid
  • Analytics: Keep internal dashboard id.
  • Reporting: Correctly apply appSubURL to report settings requests
  • Alerting: Document Grafana HA Alertmanager cluster metrics prefix change.
  • Dependency updates to core plugins and UI libraries.
  • Updates to data source provisioning and dashboard schemas.
  • Introduced dynamic dashboards in public preview.
  • Added a new side toolbar that replaces the second top toolbar to provide additional vertical space.
  • Added the ability to create dashboards from templates using sample data.
  • Revamped the gauge visualization with rounded bars, configurable bar thickness, and endpoint markers.
  • Added support to map one variable to multiple values.
  • Released a completely redesigned logs visualization.
  • Added the ability to export dashboards directly as PNG images.
  • Introduced an interactive learning experience within the Grafana UI.
  • Added a Switch template variable type to quickly toggle between values in queries.
  • Added functionality to style table cells using CSS properties via the field cell option.
  • Added support for Entra Workload Identity to enhance authentication capabilities with federated credentials.
  • Redesigned the alert rule list page.
  • Renamed Mute Timings to Active Time Intervals in Grafana Alerting.
  • Added support for Service Account Impersonation in the BigQuery data source.
  • Introduced the Grafana Advisor in public preview.
  • Introduced a new dashboard schema to replace the original single grid layout.
  • MIGRATION: Triggered a full-table rewrite for the annotation table, which may temporarily increase disk usage.
Record
SUSE-SU-2026:3714-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
react-router
npm
 7.5.1 up to 7.13.2
7.13.2
react-router
TuxCare:npm
From an advisory covering 2 CVEs
 7.5.1-tuxcare.0 up to 7.5.1-tuxcare.10, plus listed versions
7.5.17.5.1-tuxcare.17.5.1-tuxcare.27.5.1-tuxcare.37.5.1-tuxcare.4
Show 5 moreShow less
7.5.1-tuxcare.57.5.1-tuxcare.67.5.1-tuxcare.77.5.1-tuxcare.87.5.1-tuxcare.9
7.5.1-tuxcare.10
react-router-dev
TuxCare:npm
From an advisory covering 2 CVEs
 7.5.1-tuxcare.0 up to 7.5.1-tuxcare.10, plus listed versions
7.5.17.5.1-tuxcare.17.5.1-tuxcare.27.5.1-tuxcare.37.5.1-tuxcare.4
Show 5 moreShow less
7.5.1-tuxcare.57.5.1-tuxcare.67.5.1-tuxcare.77.5.1-tuxcare.87.5.1-tuxcare.9
7.5.1-tuxcare.10
@react-router/architect
TuxCare:npm
From an advisory covering 2 CVEs
 7.5.1-tuxcare.0 up to 7.5.1-tuxcare.10, plus listed versions
7.5.17.5.1-tuxcare.17.5.1-tuxcare.47.5.1-tuxcare.57.5.1-tuxcare.67.5.1-tuxcare.77.5.1-tuxcare.87.5.1-tuxcare.9
7.5.1-tuxcare.10
@react-router/cloudflare
TuxCare:npm
From an advisory covering 2 CVEs
 7.5.1-tuxcare.0 up to 7.5.1-tuxcare.10, plus listed versions
7.5.17.5.1-tuxcare.17.5.1-tuxcare.47.5.1-tuxcare.57.5.1-tuxcare.67.5.1-tuxcare.77.5.1-tuxcare.87.5.1-tuxcare.9
7.5.1-tuxcare.10
@react-router/remix-routes-option-adapter
TuxCare:npm
From an advisory covering 2 CVEs
 7.5.1-tuxcare.0 up to 7.5.1-tuxcare.10, plus listed versions
7.5.17.5.1-tuxcare.17.5.1-tuxcare.47.5.1-tuxcare.57.5.1-tuxcare.67.5.1-tuxcare.77.5.1-tuxcare.87.5.1-tuxcare.9
7.5.1-tuxcare.10
@react-router/fs-routes
TuxCare:npm
From an advisory covering 2 CVEs
 7.5.1-tuxcare.0 up to 7.5.1-tuxcare.10, plus listed versions
7.5.17.5.1-tuxcare.17.5.1-tuxcare.47.5.1-tuxcare.57.5.1-tuxcare.67.5.1-tuxcare.77.5.1-tuxcare.87.5.1-tuxcare.9
7.5.1-tuxcare.10
create-react-router
TuxCare:npm
From an advisory covering 2 CVEs
 7.5.1-tuxcare.0 up to 7.5.1-tuxcare.10, plus listed versions
7.5.17.5.1-tuxcare.17.5.1-tuxcare.47.5.1-tuxcare.57.5.1-tuxcare.67.5.1-tuxcare.77.5.1-tuxcare.87.5.1-tuxcare.9
7.5.1-tuxcare.10
react-router
TuxCare:npm
From an advisory covering 2 CVEs
 7.13.1-tuxcare.0 up to 7.13.1-tuxcare.4, plus listed versions
7.13.17.13.1-tuxcare.17.13.1-tuxcare.27.13.1-tuxcare.3
7.13.1-tuxcare.4
golang-github-prometheus-alertmanager
SUSE:Multi Linux Manager Tools SLE-15
From an advisory covering 8 CVEs
 before 0.28.1-150002.4.14.1
0.28.1-150002.4.14.1
Show 5 moreShow less
Affected packages
PackageAffectedFixed
golang-github-prometheus-prometheus
SUSE:Multi Linux Manager Tools SLE-15
From an advisory covering 8 CVEs
 before 3.5.4-150002.3.16.1
3.5.4-150002.3.16.1
grafana
SUSE:Multi Linux Manager Tools SLE-15
From an advisory covering 8 CVEs
 before 12.4.5-150002.4.24.1
12.4.5-150002.4.24.1
golang-github-prometheus-alertmanager
SUSE:Manager Client Tools 15
From an advisory covering 9 CVEs
 before 0.28.1-150100.4.34.1
0.28.1-150100.4.34.1
golang-github-prometheus-prometheus
SUSE:Manager Client Tools 15
From an advisory covering 9 CVEs
 before 3.5.4-150000.3.75.1
3.5.4-150000.3.75.1
grafana
SUSE:Manager Client Tools 15
From an advisory covering 9 CVEs
 before 12.4.5-150000.1.98.1
12.4.5-150000.1.98.1

History

History
RecordedChangedSources
affected
affected, aliases, factsOSV
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-33244 is a medium vulnerability (CVSS 5.4) in @tanstack React-router, published June 2, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.14%, the 3rd percentile. Fixed in react-router 7.13.2.

References

Show 24 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open