{"id":"CVE-2026-34077","aliases":["CLSA-2026-1788960805","CLSA-2026-1792192714","CLSA-2026-1792253403","CLSA-2026-1792419115","CLSA-2026-1792419193","CLSA-2026-1792421947","CLSA-2026-1792425411","CLSA-2026-1792430035","EUVD-2026-33994","GHSA-8v8x-cx79-35w7","GHSA-rxv8-25v2-qmq8","ROOT-APP-NPM-CVE-2026-34077","openSUSE-SU-2026:11128-1"],"status":"published","title":"React Router vulnerable to Denial of Service via reflected user input in single-fetch","description":"React Router is a router for React. In versions 7.7.0 through 7.13.1, when using React Router's unstable React Server Components (RSC) APIs, there is a potential client-side Cross-Site Scripting (XSS) vulnerability in the RSC redirect handling if redirects come from untrusted sources. This does not impact applications that are not using the unstable RSC APIs in React Router. This is patched in version 7.13.2.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00294,"percentile":0.22229,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-770"],"published":"2026-06-02T17:31:35Z","modified":"2026-10-28T02:30:42Z","fixes":[{"ecosystem":"npm","package":"react-router","fixed_in":["7.14.0"],"sources":["ghsa","osv"]},{"ecosystem":"npm","package":"turbo-stream","fixed_in":["3.0.0"],"sources":["ghsa","osv"]},{"ecosystem":"Root:npm","package":"react-router","fixed_in":["7.12.0-aikido.2","7.12.0-aikido.3"],"sources":["osv"]},{"ecosystem":"Root:npm","package":"@rootio/react-router","fixed_in":["7.12.0-root.io.2","7.12.0-root.io.3"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"agama-web-ui","fixed_in":["22+143.ee15dea20-46.1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"react-router","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.0.0"},{"fixed":"7.14.0"}]}]},{"source":"ghsa","ecosystem":"npm","package":"turbo-stream","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.0"}]}]},{"source":"osv","ecosystem":"TuxCare:npm","package":"react-router","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.5.1-tuxcare.0"},{"fixed":"7.5.1-tuxcare.10"}]}],"versions":["7.5.1","7.5.1-tuxcare.1","7.5.1-tuxcare.2","7.5.1-tuxcare.3","7.5.1-tuxcare.4","7.5.1-tuxcare.5","7.5.1-tuxcare.6","7.5.1-tuxcare.7","7.5.1-tuxcare.8","7.5.1-tuxcare.9"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:npm","package":"react-router-dev","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.5.1-tuxcare.0"},{"fixed":"7.5.1-tuxcare.10"}]}],"versions":["7.5.1","7.5.1-tuxcare.1","7.5.1-tuxcare.2","7.5.1-tuxcare.3","7.5.1-tuxcare.4","7.5.1-tuxcare.5","7.5.1-tuxcare.6","7.5.1-tuxcare.7","7.5.1-tuxcare.8","7.5.1-tuxcare.9"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:npm","package":"react-router","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.13.1-tuxcare.0"},{"fixed":"7.13.1-tuxcare.1"}]}],"versions":["7.13.1"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:npm","package":"react-router-dom","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.13.1-tuxcare.0"},{"fixed":"7.13.1-tuxcare.1"}]}],"versions":["7.13.1"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:npm","package":"@react-router/architect","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.5.1-tuxcare.0"},{"fixed":"7.5.1-tuxcare.10"}]}],"versions":["7.5.1","7.5.1-tuxcare.1","7.5.1-tuxcare.4","7.5.1-tuxcare.5","7.5.1-tuxcare.6","7.5.1-tuxcare.7","7.5.1-tuxcare.8","7.5.1-tuxcare.9"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:npm","package":"@react-router/cloudflare","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.5.1-tuxcare.0"},{"fixed":"7.5.1-tuxcare.10"}]}],"versions":["7.5.1","7.5.1-tuxcare.1","7.5.1-tuxcare.4","7.5.1-tuxcare.5","7.5.1-tuxcare.6","7.5.1-tuxcare.7","7.5.1-tuxcare.8","7.5.1-tuxcare.9"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:npm","package":"@react-router/remix-routes-option-adapter","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.5.1-tuxcare.0"},{"fixed":"7.5.1-tuxcare.10"}]}],"versions":["7.5.1","7.5.1-tuxcare.1","7.5.1-tuxcare.4","7.5.1-tuxcare.5","7.5.1-tuxcare.6","7.5.1-tuxcare.7","7.5.1-tuxcare.8","7.5.1-tuxcare.9"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:npm","package":"@react-router/fs-routes","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.5.1-tuxcare.0"},{"fixed":"7.5.1-tuxcare.10"}]}],"versions":["7.5.1","7.5.1-tuxcare.1","7.5.1-tuxcare.4","7.5.1-tuxcare.5","7.5.1-tuxcare.6","7.5.1-tuxcare.7","7.5.1-tuxcare.8","7.5.1-tuxcare.9"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:npm","package":"create-react-router","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.5.1-tuxcare.0"},{"fixed":"7.5.1-tuxcare.10"}]}],"versions":["7.5.1","7.5.1-tuxcare.1","7.5.1-tuxcare.4","7.5.1-tuxcare.5","7.5.1-tuxcare.6","7.5.1-tuxcare.7","7.5.1-tuxcare.8","7.5.1-tuxcare.9"],"bundled":2},{"source":"osv","ecosystem":"npm","package":"react-router","ranges":[{"type":"SEMVER","events":[{"introduced":"7.0.0"},{"fixed":"7.14.0"}]}]},{"source":"osv","ecosystem":"npm","package":"turbo-stream","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"3.0.0"}]}]},{"source":"osv","ecosystem":"Root:npm","package":"react-router","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.12.0-aikido.2"},{"fixed":"7.12.0-aikido.3"}]}]},{"source":"osv","ecosystem":"Root:npm","package":"@rootio/react-router","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.12.0-root.io.2"},{"fixed":"7.12.0-root.io.3"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"agama-web-ui","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"22+143.ee15dea20-46.1"}]}]}],"products":[{"vendor":"@tanstack","product":"react-router"},{"vendor":"remix-run","product":"react-router"},{"vendor":"remix-run","product":"turbo-stream"},{"vendor":"shopify","product":"react-router"},{"vendor":"turbo-stream","product":"turbo_stream"}],"references":[{"url":"https://github.com/remix-run/react-router/security/advisories/GHSA-rxv8-25v2-qmq8","tags":["x_refsource_CONFIRM","Vendor Advisory","advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-34077","tags":["advisory"]},{"url":"https://github.com/remix-run/react-router/commit/59811921d3c7d599077b8cadccdcd65a233165e0","tags":["web"]},{"url":"https://github.com/jacob-ebey/turbo-stream/blob/v2.4.1/src/flatten.ts#L175-L177","tags":["web"]},{"url":"https://github.com/jacob-ebey/turbo-stream/blob/v2.4.1/src/unflatten.ts#L185-L189","tags":["web"]},{"url":"https://github.com/advisories/GHSA-rxv8-25v2-qmq8"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/34xxx/CVE-2026-34077.json","tags":["advisory"]},{"url":"https://github.com/remix-run/react-router","tags":["package"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2026-34077","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2026-34077","title":"React Router vulnerable to Denial of Service via reflected user input in single-fetch","description":"React Router is a router for React. In versions 7.7.0 through 7.13.1, when using React Router's unstable React Server Components (RSC) APIs, there is a potential client-side Cross-Site Scripting (XSS) vulnerability in the RSC redirect handling if redirects come from untrusted sources. This does not impact applications that are not using the unstable RSC APIs in React Router. This is patched in version 7.13.2.","status":"published","published":"2026-06-02T17:31:35.579Z","modified":"2026-06-03T13:19:02.279Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-770"],"updated_at":"2026-11-02T14:20:14.302133Z"}],"euvd":[{"id":"EUVD-2026-33994","description":"React Router is a router for React. In versions 7.7.0 through 7.13.1, when using React Router's unstable React Server Components (RSC) APIs, there is a potential client-side Cross-Site Scripting (XSS) vulnerability in the RSC redirect handling if redirects come from untrusted sources. This does not impact applications that are not using the unstable RSC APIs in React Router. This is patched in version 7.13.2.","status":"published","published":"2026-06-02T17:31:35Z","modified":"2026-06-03T13:19:02Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T18:20:54.727632Z"}],"ghsa":[{"id":"GHSA-rxv8-25v2-qmq8","title":"React Router vulnerable to Denial of Service via reflected user input in single-fetch","description":"A DoS vulnerability exists in the React Router v7 [Framework Mode](https://reactrouter.com/start/modes#framework), as well as Remix v2.9.0+ with [Single Fetch](https://v2.remix.run/docs/guides/single-fetch) enabled. In some scenarios the underlying serialization algorithm can become a bottleneck when encoding specific types of data into server responses.  Please upgrade to React Router v7.14.0 or later.\n\n\u003e [!NOTE]\n\u003e This does not impact your React Router application if you are using [Declarative Mode](https://reactrouter.com/start/modes#declarative) (`\u003cBrowserRouter\u003e`) or [Data Mode](https://reactrouter.com/start/modes#data) (`createBrowserRouter`/`\u003cRouterProvider\u003e`).","status":"published","published":"2026-06-04T15:23:51Z","modified":"2026-06-04T15:23:51Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-770"],"updated_at":"2026-11-02T14:40:16.698699Z"}],"nvd":[{"id":"CVE-2026-34077","description":"React Router is a router for React. In versions 7.7.0 through 7.13.1, when using React Router's unstable React Server Components (RSC) APIs, there is a potential client-side Cross-Site Scripting (XSS) vulnerability in the RSC redirect handling if redirects come from untrusted sources. This does not impact applications that are not using the unstable RSC APIs in React Router. This is patched in version 7.13.2.","status":"published","published":"2026-06-02T20:16:34.62Z","modified":"2026-07-22T19:10:00.12Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-770"],"updated_at":"2026-11-02T14:12:22.022466Z"}],"osv":[{"id":"CVE-2026-34077","title":"React Router vulnerable to Denial of Service via reflected user input in single-fetch","description":"React Router is a router for React. In versions 7.7.0 through 7.13.1, when using React Router's unstable React Server Components (RSC) APIs, there is a potential client-side Cross-Site Scripting (XSS) vulnerability in the RSC redirect handling if redirects come from untrusted sources. This does not impact applications that are not using the unstable RSC APIs in React Router. This is patched in version 7.13.2.","status":"published","published":"2026-06-02T17:31:35.579Z","modified":"2026-10-28T02:30:42.074961518Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-770"],"updated_at":"2026-11-02T15:45:02.247031Z"},{"id":"GHSA-rxv8-25v2-qmq8","title":"React Router vulnerable to Denial of Service via reflected user input in single-fetch","description":"A DoS vulnerability exists in the React Router v7 [Framework Mode](https://reactrouter.com/start/modes#framework), as well as Remix v2.9.0+ with [Single Fetch](https://v2.remix.run/docs/guides/single-fetch) enabled. In some scenarios the underlying serialization algorithm can become a bottleneck when encoding specific types of data into server responses.  Please upgrade to React Router v7.14.0 or later.\n\n\u003e [!NOTE]\n\u003e This does not impact your React Router application if you are using [Declarative Mode](https://reactrouter.com/start/modes#declarative) (`\u003cBrowserRouter\u003e`) or [Data Mode](https://reactrouter.com/start/modes#data) (`createBrowserRouter`/`\u003cRouterProvider\u003e`).","status":"published","published":"2026-06-04T15:23:51Z","modified":"2026-06-04T15:41:24.712338Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-770"],"updated_at":"2026-11-02T15:46:56.639206Z"},{"id":"CLSA-2026-1788960805","title":"TuxCare security update for 2 packages (3 CVEs)","description":"TuxCare rebuilt 2 packages to address 3 CVEs. Fixed in 7.5.1-tuxcare.10.","status":"published","published":"2026-09-09T13:33:25Z","modified":"2026-10-19T19:15:10.875246428Z","updated_at":"2026-11-02T15:43:47.938828Z"},{"id":"CLSA-2026-1792192714","title":"TuxCare security update for react-router (3 CVEs)","description":"TuxCare rebuilt react-router to address 3 CVEs. Fixed in 7.13.1-tuxcare.1.","status":"published","published":"2026-10-16T23:18:34Z","modified":"2026-10-26T13:21:31Z","updated_at":"2026-11-02T15:43:51.747192Z"},{"id":"CLSA-2026-1792253403","title":"TuxCare security update for react-router-dom (3 CVEs)","description":"TuxCare rebuilt react-router-dom to address 3 CVEs. Fixed in 7.13.1-tuxcare.1.","status":"published","published":"2026-10-17T16:09:59Z","modified":"2026-10-17T19:01:35.064087013Z","updated_at":"2026-11-02T15:43:52.011757Z"},{"id":"CLSA-2026-1792419115","title":"TuxCare security update for @react-router/architect (3 CVEs)","description":"TuxCare rebuilt @react-router/architect to address 3 CVEs. Fixed in 7.5.1-tuxcare.10.","status":"published","published":"2026-10-19T14:11:51Z","modified":"2026-10-19T19:15:14.333850689Z","updated_at":"2026-11-02T15:43:54.119956Z"},{"id":"CLSA-2026-1792419193","title":"TuxCare security update for @react-router/cloudflare (3 CVEs)","description":"TuxCare rebuilt @react-router/cloudflare to address 3 CVEs. Fixed in 7.5.1-tuxcare.10.","status":"published","published":"2026-10-19T14:13:09Z","modified":"2026-10-19T19:15:07.964337227Z","updated_at":"2026-11-02T15:43:54.119956Z"},{"id":"CLSA-2026-1792421947","title":"TuxCare security update for @react-router/remix-routes-option-adapter (3 CVEs)","description":"TuxCare rebuilt @react-router/remix-routes-option-adapter to address 3 CVEs. Fixed in 7.5.1-tuxcare.10.","status":"published","published":"2026-10-19T14:59:05Z","modified":"2026-10-19T19:15:08.531421921Z","updated_at":"2026-11-02T15:43:54.119956Z"},{"id":"CLSA-2026-1792425411","title":"TuxCare security update for @react-router/fs-routes (3 CVEs)","description":"TuxCare rebuilt @react-router/fs-routes to address 3 CVEs. Fixed in 7.5.1-tuxcare.10.","status":"published","published":"2026-10-19T15:56:47Z","modified":"2026-10-19T19:15:19.738344671Z","updated_at":"2026-11-02T15:43:54.119956Z"},{"id":"CLSA-2026-1792430035","title":"TuxCare security update for create-react-router (3 CVEs)","description":"TuxCare rebuilt create-react-router to address 3 CVEs. Fixed in 7.5.1-tuxcare.10.","status":"published","published":"2026-10-19T17:13:52Z","modified":"2026-10-19T19:15:24.436796489Z","updated_at":"2026-11-02T15:43:54.119956Z"},{"id":"openSUSE-SU-2026:11128-1","title":"agama-web-ui-22+143.ee15dea20-46.1 on GA media","description":"These are all security issues fixed in the agama-web-ui-22+143.ee15dea20-46.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-06-27T00:00:00Z","modified":"2026-06-29T09:45:06.970245468Z","updated_at":"2026-11-02T16:58:38.95195Z"},{"id":"ROOT-APP-NPM-CVE-2026-34077","title":"CVE-2026-34077 in react-router - Patched by Root","description":"Root has patched CVE-2026-34077 in the react-router package for Root:npm. Multiple fixed versions available.","status":"published","published":"2026-08-04T12:12:16Z","modified":"2026-08-04T19:30:17.539414403Z","updated_at":"2026-11-02T15:53:27.649662Z"}]}}