{"id":"CVE-2026-55685","aliases":["CLSA-2026-1784856417","CLSA-2026-1791052929","CLSA-2026-1792139276","CLSA-2026-1792253398","CLSA-2026-1792253413","CLSA-2026-1792253415","CLSA-2026-1792419113","CLSA-2026-1792419118","CLSA-2026-1792419191","CLSA-2026-1792419194","CLSA-2026-1792419269","CLSA-2026-1792419273","CLSA-2026-1792419625","CLSA-2026-1792419628","CLSA-2026-1792421943","CLSA-2026-1792421948","CLSA-2026-1792424732","CLSA-2026-1792424737","CLSA-2026-1792425407","CLSA-2026-1792425410","CLSA-2026-1792428108","CLSA-2026-1792428114","CLSA-2026-1792430032","CLSA-2026-1792430036","CLSA-2026-1793099986","CLSA-2026-1793110184","CLSA-2026-1793125641","EUVD-2026-49634","GHSA-chx6-hx7r-mcp5","GHSA-qwww-vcr4-c8h2","ROOT-APP-NPM-CVE-2026-55685","ROOT-APP-NPM-GHSA-qwww-vcr4-c8h2"],"status":"published","title":"React Router: Unauthenticated Denial of Service via Inefficient Route Matching","description":"React Router is a router for React. In versions 7.0.0 through 7.17.0, the manifest endpoint could be accessed via unauthenticated targeted requests that would put heavy load on the server and slow down response times. This issue is a follow up to CVE-2026-42342, and does not does not impact React Router applications using Declarative Mode (\u003cBrowserRouter\u003e) or Data Mode (createBrowserRouter/\u003cRouterProvider\u003e). This issue has been fixed in version 7.18.0.","severity":{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00708,"percentile":0.5375,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-352","CWE-400","CWE-407"],"published":"2026-07-24T14:06:57Z","modified":"2026-11-06T13:28:04Z","fixes":[{"ecosystem":"npm","package":"react-router","fixed_in":["7.18.0","7.18.2","8.3.0"],"sources":["ghsa","osv"]},{"ecosystem":"TuxCare:npm","package":"react-router","fixed_in":["7.5.1-tuxcare.7","7.18.1-tuxcare.1","7.15.0-tuxcare.2","7.14.2-tuxcare.2","7.13.1-tuxcare.3"],"sources":["osv"]},{"ecosystem":"TuxCare:npm","package":"react-router-dev","fixed_in":["7.5.1-tuxcare.7"],"sources":["osv"]},{"ecosystem":"TuxCare:npm","package":"react-router-dom","fixed_in":["7.5.1-tuxcare.7","7.18.1-tuxcare.1","7.15.0-tuxcare.2"],"sources":["osv"]},{"ecosystem":"TuxCare:npm","package":"@react-router/architect","fixed_in":["7.5.1-tuxcare.7","7.18.1-tuxcare.1"],"sources":["osv"]},{"ecosystem":"TuxCare:npm","package":"@react-router/cloudflare","fixed_in":["7.5.1-tuxcare.7","7.18.1-tuxcare.1"],"sources":["osv"]},{"ecosystem":"TuxCare:npm","package":"@react-router/express","fixed_in":["7.5.1-tuxcare.7","7.18.1-tuxcare.1"],"sources":["osv"]},{"ecosystem":"TuxCare:npm","package":"@react-router/node","fixed_in":["7.5.1-tuxcare.7","7.18.1-tuxcare.1"],"sources":["osv"]},{"ecosystem":"TuxCare:npm","package":"@react-router/remix-routes-option-adapter","fixed_in":["7.5.1-tuxcare.7","7.18.1-tuxcare.1"],"sources":["osv"]},{"ecosystem":"TuxCare:npm","package":"@react-router/dev","fixed_in":["7.5.1-tuxcare.7","7.18.1-tuxcare.1"],"sources":["osv"]},{"ecosystem":"TuxCare:npm","package":"@react-router/fs-routes","fixed_in":["7.5.1-tuxcare.7","7.18.1-tuxcare.1"],"sources":["osv"]},{"ecosystem":"TuxCare:npm","package":"@react-router/serve","fixed_in":["7.5.1-tuxcare.7","7.18.1-tuxcare.1"],"sources":["osv"]},{"ecosystem":"TuxCare:npm","package":"create-react-router","fixed_in":["7.5.1-tuxcare.7","7.18.1-tuxcare.1"],"sources":["osv"]},{"ecosystem":"Root:npm","package":"react-router","fixed_in":["7.15.1-aikido.1","7.12.0-aikido.3","7.15.1-aikido.3","7.18.0-aikido.1"],"sources":["osv"]},{"ecosystem":"Root:npm","package":"@rootio/react-router","fixed_in":["7.15.1-root.io.1","7.12.0-root.io.3","7.15.1-root.io.3","7.18.0-root.io.1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"react-router","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.0.0"},{"fixed":"7.18.0"}]}]},{"source":"ghsa","ecosystem":"npm","package":"react-router","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.12.0"},{"fixed":"7.18.2"}]}]},{"source":"ghsa","ecosystem":"npm","package":"react-router","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.0.0"},{"fixed":"8.3.0"}]}]},{"source":"osv","ecosystem":"TuxCare:npm","package":"react-router","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.5.1-tuxcare.0"},{"fixed":"7.5.1-tuxcare.7"}]}],"versions":["7.5.1","7.5.1-tuxcare.1","7.5.1-tuxcare.2","7.5.1-tuxcare.3","7.5.1-tuxcare.4","7.5.1-tuxcare.5","7.5.1-tuxcare.6"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"react-router-dev","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.5.1-tuxcare.0"},{"fixed":"7.5.1-tuxcare.7"}]}],"versions":["7.5.1","7.5.1-tuxcare.1","7.5.1-tuxcare.2","7.5.1-tuxcare.3","7.5.1-tuxcare.4","7.5.1-tuxcare.5","7.5.1-tuxcare.6"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"react-router","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.18.1-tuxcare.0"},{"fixed":"7.18.1-tuxcare.1"}]}],"versions":["7.18.1"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"react-router","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.15.0-tuxcare.0"},{"fixed":"7.15.0-tuxcare.2"}]}],"versions":["7.15.0","7.15.0-tuxcare.1"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"react-router-dom","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.5.1-tuxcare.0"},{"fixed":"7.5.1-tuxcare.7"}]}],"versions":["7.5.1","7.5.1-tuxcare.1","7.5.1-tuxcare.4","7.5.1-tuxcare.5","7.5.1-tuxcare.6"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"react-router-dom","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.18.1-tuxcare.0"},{"fixed":"7.18.1-tuxcare.1"}]}],"versions":["7.18.1"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"react-router-dom","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.15.0-tuxcare.0"},{"fixed":"7.15.0-tuxcare.2"}]}],"versions":["7.15.0","7.15.0-tuxcare.1"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"@react-router/architect","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.5.1-tuxcare.0"},{"fixed":"7.5.1-tuxcare.7"}]}],"versions":["7.5.1","7.5.1-tuxcare.1","7.5.1-tuxcare.4","7.5.1-tuxcare.5","7.5.1-tuxcare.6"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"@react-router/architect","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.18.1-tuxcare.0"},{"fixed":"7.18.1-tuxcare.1"}]}],"versions":["7.18.1"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"@react-router/cloudflare","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.5.1-tuxcare.0"},{"fixed":"7.5.1-tuxcare.7"}]}],"versions":["7.5.1","7.5.1-tuxcare.1","7.5.1-tuxcare.4","7.5.1-tuxcare.5","7.5.1-tuxcare.6"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"@react-router/cloudflare","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.18.1-tuxcare.0"},{"fixed":"7.18.1-tuxcare.1"}]}],"versions":["7.18.1"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"@react-router/express","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.5.1-tuxcare.0"},{"fixed":"7.5.1-tuxcare.7"}]}],"versions":["7.5.1","7.5.1-tuxcare.1","7.5.1-tuxcare.4","7.5.1-tuxcare.5","7.5.1-tuxcare.6"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"@react-router/express","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.18.1-tuxcare.0"},{"fixed":"7.18.1-tuxcare.1"}]}],"versions":["7.18.1"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"@react-router/node","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.5.1-tuxcare.0"},{"fixed":"7.5.1-tuxcare.7"}]}],"versions":["7.5.1","7.5.1-tuxcare.1","7.5.1-tuxcare.4","7.5.1-tuxcare.5","7.5.1-tuxcare.6"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"@react-router/node","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.18.1-tuxcare.0"},{"fixed":"7.18.1-tuxcare.1"}]}],"versions":["7.18.1"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"@react-router/remix-routes-option-adapter","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.5.1-tuxcare.0"},{"fixed":"7.5.1-tuxcare.7"}]}],"versions":["7.5.1","7.5.1-tuxcare.1","7.5.1-tuxcare.4","7.5.1-tuxcare.5","7.5.1-tuxcare.6"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"@react-router/remix-routes-option-adapter","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.18.1-tuxcare.0"},{"fixed":"7.18.1-tuxcare.1"}]}],"versions":["7.18.1"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"@react-router/dev","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.5.1-tuxcare.0"},{"fixed":"7.5.1-tuxcare.7"}]}],"versions":["7.5.1","7.5.1-tuxcare.1","7.5.1-tuxcare.4","7.5.1-tuxcare.5","7.5.1-tuxcare.6"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"@react-router/dev","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.18.1-tuxcare.0"},{"fixed":"7.18.1-tuxcare.1"}]}],"versions":["7.18.1"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"@react-router/fs-routes","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.5.1-tuxcare.0"},{"fixed":"7.5.1-tuxcare.7"}]}],"versions":["7.5.1","7.5.1-tuxcare.1","7.5.1-tuxcare.4","7.5.1-tuxcare.5","7.5.1-tuxcare.6"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"@react-router/fs-routes","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.18.1-tuxcare.0"},{"fixed":"7.18.1-tuxcare.1"}]}],"versions":["7.18.1"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"@react-router/serve","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.5.1-tuxcare.0"},{"fixed":"7.5.1-tuxcare.7"}]}],"versions":["7.5.1","7.5.1-tuxcare.1","7.5.1-tuxcare.4","7.5.1-tuxcare.5","7.5.1-tuxcare.6"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"@react-router/serve","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.18.1-tuxcare.0"},{"fixed":"7.18.1-tuxcare.1"}]}],"versions":["7.18.1"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"create-react-router","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.5.1-tuxcare.0"},{"fixed":"7.5.1-tuxcare.7"}]}],"versions":["7.5.1","7.5.1-tuxcare.1","7.5.1-tuxcare.4","7.5.1-tuxcare.5","7.5.1-tuxcare.6"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"create-react-router","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.18.1-tuxcare.0"},{"fixed":"7.18.1-tuxcare.1"}]}],"versions":["7.18.1"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"react-router","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.14.1-tuxcare.0"},{"fixed":"7.14.1-tuxcare.2"}]}],"versions":["7.14.1","7.14.1-tuxcare.1"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:npm","package":"react-router","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.14.2-tuxcare.0"},{"fixed":"7.14.2-tuxcare.2"}]}],"versions":["7.14.2","7.14.2-tuxcare.1"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"react-router","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.13.1-tuxcare.0"},{"fixed":"7.13.1-tuxcare.3"}]}],"versions":["7.13.1","7.13.1-tuxcare.1","7.13.1-tuxcare.2"]},{"source":"osv","ecosystem":"npm","package":"react-router","ranges":[{"type":"SEMVER","events":[{"introduced":"7.0.0"},{"fixed":"7.18.0"}]}]},{"source":"osv","ecosystem":"npm","package":"react-router","ranges":[{"type":"SEMVER","events":[{"introduced":"7.12.0"},{"fixed":"7.18.2"}]}]},{"source":"osv","ecosystem":"npm","package":"react-router","ranges":[{"type":"SEMVER","events":[{"introduced":"8.0.0"},{"fixed":"8.3.0"}]}]},{"source":"osv","ecosystem":"Root:npm","package":"react-router","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.15.1-aikido.1"},{"fixed":"7.12.0-aikido.3"},{"fixed":"7.15.1-aikido.3"},{"fixed":"7.18.0-aikido.1"}]}]},{"source":"osv","ecosystem":"Root:npm","package":"@rootio/react-router","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.15.1-root.io.1"},{"fixed":"7.12.0-root.io.3"},{"fixed":"7.15.1-root.io.3"},{"fixed":"7.18.0-root.io.1"}]}]},{"source":"osv","ecosystem":"Root:npm","package":"react-router","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.12.0-aikido.3"},{"fixed":"7.15.1-aikido.3"},{"fixed":"7.18.0-aikido.1"}]}]},{"source":"osv","ecosystem":"Root:npm","package":"@rootio/react-router","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.12.0-root.io.3"},{"fixed":"7.15.1-root.io.3"},{"fixed":"7.18.0-root.io.1"}]}]}],"products":[{"vendor":"@tanstack","product":"react-router"},{"vendor":"remix-run","product":"react-router"},{"vendor":"shopify","product":"react-router"}],"references":[{"url":"https://github.com/remix-run/react-router/security/advisories/GHSA-chx6-hx7r-mcp5","tags":["x_refsource_CONFIRM","Third Party Advisory","advisory","web"]},{"url":"https://github.com/remix-run/react-router/security/advisories/GHSA-8x6r-g9mw-2r78","tags":["x_refsource_MISC","Third Party Advisory","advisory"]},{"url":"https://github.com/remix-run/react-router/pull/15186","tags":["x_refsource_MISC","Issue Tracking","Patch","fix","web"]},{"url":"https://github.com/remix-run/react-router/commit/09e6020d1950e54f361f7ad00938ecd4dde60929","tags":["x_refsource_MISC","Patch","fix","web"]},{"url":"https://github.com/remix-run/react-router/blob/main/CHANGELOG.md#v7180","tags":["x_refsource_MISC","Release Notes","web"]},{"url":"https://github.com/remix-run/react-router/releases/tag/react-router@7.18.0","tags":["x_refsource_MISC","Release Notes","web"]},{"url":"https://github.com/advisories/GHSA-chx6-hx7r-mcp5"},{"url":"https://github.com/remix-run/react-router/security/advisories/GHSA-qwww-vcr4-c8h2","tags":["web"]},{"url":"https://github.com/remix-run/react-router/commit/7a71c728ad116bd78699a258b2014ce9585729f5","tags":["web"]},{"url":"https://github.com/remix-run/react-router/blob/main/CHANGELOG.md#v830","tags":["web"]},{"url":"https://github.com/remix-run/react-router/releases/tag/react-router@8.3.0","tags":["web"]},{"url":"http://github.com/remix-run/react-router/pull/15311","tags":["web"]},{"url":"https://github.com/remix-run/react-router/pull/15353","tags":["web"]},{"url":"https://github.com/remix-run/react-router/commit/8ebd5df9932854547963e3255c8454e62430e05d","tags":["web"]},{"url":"https://github.com/remix-run/react-router/blob/v7/CHANGELOG.md#v7182","tags":["web"]},{"url":"https://github.com/remix-run/react-router/releases/tag/react-router%407.18.2","tags":["web"]},{"url":"https://github.com/advisories/GHSA-qwww-vcr4-c8h2"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/55xxx/CVE-2026-55685.json","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-55685","tags":["advisory"]},{"url":"https://github.com/remix-run/react-router","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2026-55685","title":"React Router: Unauthenticated Denial of Service via Inefficient Route Matching","description":"React Router is a router for React. In versions 7.0.0 through 7.17.0, the manifest endpoint could be accessed via unauthenticated targeted requests that would put heavy load on the server and slow down response times. This issue is a follow up to CVE-2026-42342, and does not does not impact React Router applications using Declarative Mode (\u003cBrowserRouter\u003e) or Data Mode (createBrowserRouter/\u003cRouterProvider\u003e). This issue has been fixed in version 7.18.0.","status":"published","published":"2026-07-27T21:45:57.751Z","modified":"2026-07-28T13:40:04.996Z","cvss":[{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"high","assessor":"cna"}],"cwes":["CWE-400","CWE-407"],"updated_at":"2026-11-02T14:20:11.925815Z"}],"euvd":[{"id":"EUVD-2026-49634","description":"React Router is a router for React. In versions 7.0.0 through 7.17.0, the manifest endpoint could be accessed via unauthenticated targeted requests that would put heavy load on the server and slow down response times. This issue is a follow up to CVE-2026-42342, and does not does not impact React Router applications using Declarative Mode (\u003cBrowserRouter\u003e) or Data Mode (createBrowserRouter/\u003cRouterProvider\u003e). This issue has been fixed in version 7.18.0.","status":"published","published":"2026-07-27T21:45:57Z","modified":"2026-07-28T13:40:04Z","cvss":[{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"high"}],"updated_at":"2026-11-02T18:02:31.827348Z"}],"ghsa":[{"id":"GHSA-chx6-hx7r-mcp5","title":"React Router: Unauthenticated Denial of Service via Inefficient Route Matching","description":"This is a follow up to https://github.com/remix-run/react-router/security/advisories/GHSA-8x6r-g9mw-2r78 that covers additional reported scenarios in which the manifest endpoint could be accessed via unauthenticated targeted requests that would put heavy load on the server and slow down response times.\n\n\u003e [!NOTE]\n\u003e This only impacts Framework Mode applications.  This does not impact your application if you are using Declarative or Data Mode.","status":"published","published":"2026-07-24T14:06:57Z","modified":"2026-07-24T14:06:58Z","cvss":[{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"high"}],"cwes":["CWE-400","CWE-407"],"updated_at":"2026-11-02T14:40:52.46233Z"},{"id":"GHSA-qwww-vcr4-c8h2","title":"React Router: RSC Mode CSRF Bypass Allows Action Execution Before 400 Response","description":"This is a follow up to CVE-2026-22030 to address related CSRF flows in unstable RSC code paths.\n\n\u003e [!NOTE]\n\u003e This only affects your application if you are using the unstable RSC APIs","status":"published","published":"2026-07-24T16:44:43Z","modified":"2026-08-07T18:16:54Z","cvss":[{"version":"4.0","score":7.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N","level":"high"}],"cwes":["CWE-352"],"updated_at":"2026-11-02T14:40:57.999375Z"}],"nvd":[{"id":"CVE-2026-55685","description":"React Router is a router for React. In versions 7.0.0 through 7.17.0, the manifest endpoint could be accessed via unauthenticated targeted requests that would put heavy load on the server and slow down response times. This issue is a follow up to CVE-2026-42342, and does not does not impact React Router applications using Declarative Mode (\u003cBrowserRouter\u003e) or Data Mode (createBrowserRouter/\u003cRouterProvider\u003e). This issue has been fixed in version 7.18.0.","status":"published","published":"2026-07-27T22:17:40.86Z","modified":"2026-10-24T13:10:00.147Z","cvss":[{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high","assessor":"secondary"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary"}],"cwes":["CWE-400","CWE-407"],"updated_at":"2026-11-02T14:12:33.249634Z"}],"osv":[{"id":"CVE-2026-55685","title":"React Router: Unauthenticated Denial of Service via Inefficient Route Matching","description":"React Router is a router for React. In versions 7.0.0 through 7.17.0, the manifest endpoint could be accessed via unauthenticated targeted requests that would put heavy load on the server and slow down response times. This issue is a follow up to CVE-2026-42342, and does not does not impact React Router applications using Declarative Mode (\u003cBrowserRouter\u003e) or Data Mode (createBrowserRouter/\u003cRouterProvider\u003e). This issue has been fixed in version 7.18.0.","status":"published","published":"2026-07-27T21:45:57.751Z","modified":"2026-10-28T02:30:40.086759183Z","cvss":[{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"high"}],"cwes":["CWE-400","CWE-407"],"updated_at":"2026-11-02T15:45:11.22012Z"},{"id":"GHSA-chx6-hx7r-mcp5","title":"React Router: Unauthenticated Denial of Service via Inefficient Route Matching","description":"This is a follow up to https://github.com/remix-run/react-router/security/advisories/GHSA-8x6r-g9mw-2r78 that covers additional reported scenarios in which the manifest endpoint could be accessed via unauthenticated targeted requests that would put heavy load on the server and slow down response times.\n\n\u003e [!NOTE]\n\u003e This only impacts Framework Mode applications.  This does not impact your application if you are using Declarative or Data Mode.","status":"published","published":"2026-07-24T14:06:57Z","modified":"2026-09-10T03:51:11.397587276Z","cvss":[{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"high"}],"cwes":["CWE-400","CWE-407"],"updated_at":"2026-11-02T15:46:45.28161Z"},{"id":"GHSA-qwww-vcr4-c8h2","title":"React Router: RSC Mode CSRF Bypass Allows Action Execution Before 400 Response","description":"This is a follow up to CVE-2026-22030 to address related CSRF flows in unstable RSC code paths.\n\n\u003e [!NOTE]\n\u003e This only affects your application if you are using the unstable RSC APIs","status":"published","published":"2026-07-24T16:44:43Z","modified":"2026-09-10T03:50:52.95544184Z","cvss":[{"version":"4.0","score":7.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N","level":"high"}],"cwes":["CWE-352"],"updated_at":"2026-11-02T15:46:55.122811Z"},{"id":"CLSA-2026-1784856417","title":"TuxCare security update for 2 packages (1 CVE)","description":"TuxCare rebuilt 2 packages to address 1 CVE. Fixed in 7.5.1-tuxcare.7.","status":"published","published":"2026-08-04T14:52:48Z","modified":"2026-10-19T19:15:13.444452685Z","updated_at":"2026-11-02T15:43:46.482572Z"},{"id":"CLSA-2026-1791052929","title":"TuxCare security update for react-router (1 CVE)","description":"TuxCare rebuilt react-router to address 1 CVE. Fixed in 7.18.1-tuxcare.1.","status":"published","published":"2026-10-03T18:42:09Z","modified":"2026-10-19T19:15:14.31367759Z","updated_at":"2026-11-02T15:43:49.016976Z"},{"id":"CLSA-2026-1792139276","title":"TuxCare security update for react-router (2 CVEs)","description":"TuxCare rebuilt react-router to address 2 CVEs. Fixed in 7.15.0-tuxcare.2.","status":"published","published":"2026-10-16T08:27:56Z","modified":"2026-10-17T19:01:21.976075547Z","updated_at":"2026-11-02T15:43:50.949147Z"},{"id":"CLSA-2026-1792253398","title":"TuxCare security update for react-router-dom (1 CVE)","description":"TuxCare rebuilt react-router-dom to address 1 CVE. Fixed in 7.5.1-tuxcare.7.","status":"published","published":"2026-10-17T16:09:55Z","modified":"2026-10-17T19:01:42.616488122Z","updated_at":"2026-11-02T15:43:52.011757Z"},{"id":"CLSA-2026-1792253413","title":"TuxCare security update for react-router-dom (1 CVE)","description":"TuxCare rebuilt react-router-dom to address 1 CVE. Fixed in 7.18.1-tuxcare.1.","status":"published","published":"2026-10-17T16:10:13Z","modified":"2026-10-17T19:01:43.562562812Z","updated_at":"2026-11-02T15:43:52.011757Z"},{"id":"CLSA-2026-1792253415","title":"TuxCare security update for react-router-dom (2 CVEs)","description":"TuxCare rebuilt react-router-dom to address 2 CVEs. Fixed in 7.15.0-tuxcare.2.","status":"published","published":"2026-10-17T16:10:13Z","modified":"2026-10-17T19:01:43.575357115Z","updated_at":"2026-11-02T15:43:52.011757Z"},{"id":"CLSA-2026-1792419113","title":"TuxCare security update for @react-router/architect (1 CVE)","description":"TuxCare rebuilt @react-router/architect to address 1 CVE. Fixed in 7.5.1-tuxcare.7.","status":"published","published":"2026-10-19T14:11:50Z","modified":"2026-10-19T19:15:09.524119055Z","updated_at":"2026-11-02T15:43:54.119956Z"},{"id":"CLSA-2026-1792419118","title":"TuxCare security update for @react-router/architect (1 CVE)","description":"TuxCare rebuilt @react-router/architect to address 1 CVE. Fixed in 7.18.1-tuxcare.1.","status":"published","published":"2026-10-19T14:11:55Z","modified":"2026-10-19T19:15:15.339389351Z","updated_at":"2026-11-02T15:43:54.119956Z"},{"id":"CLSA-2026-1792419191","title":"TuxCare security update for @react-router/cloudflare (1 CVE)","description":"TuxCare rebuilt @react-router/cloudflare to address 1 CVE. Fixed in 7.5.1-tuxcare.7.","status":"published","published":"2026-10-19T14:13:08Z","modified":"2026-10-19T19:15:09.729782766Z","updated_at":"2026-11-02T15:43:54.119956Z"},{"id":"CLSA-2026-1792419194","title":"TuxCare security update for @react-router/cloudflare (1 CVE)","description":"TuxCare rebuilt @react-router/cloudflare to address 1 CVE. Fixed in 7.18.1-tuxcare.1.","status":"published","published":"2026-10-19T14:13:11Z","modified":"2026-10-19T19:15:08.529386826Z","updated_at":"2026-11-02T15:43:54.119956Z"},{"id":"CLSA-2026-1792419269","title":"TuxCare security update for @react-router/express (1 CVE)","description":"TuxCare rebuilt @react-router/express to address 1 CVE. Fixed in 7.5.1-tuxcare.7.","status":"published","published":"2026-10-19T14:14:27Z","modified":"2026-10-19T19:15:18.338801477Z","updated_at":"2026-11-02T15:43:54.119956Z"},{"id":"CLSA-2026-1792419273","title":"TuxCare security update for @react-router/express (1 CVE)","description":"TuxCare rebuilt @react-router/express to address 1 CVE. Fixed in 7.18.1-tuxcare.1.","status":"published","published":"2026-10-19T14:14:30Z","modified":"2026-10-19T19:15:17.446333426Z","updated_at":"2026-11-02T15:43:54.119956Z"},{"id":"CLSA-2026-1792419625","title":"TuxCare security update for @react-router/node (1 CVE)","description":"TuxCare rebuilt @react-router/node to address 1 CVE. Fixed in 7.5.1-tuxcare.7.","status":"published","published":"2026-10-19T14:20:23Z","modified":"2026-10-19T19:15:18.835606484Z","updated_at":"2026-11-02T15:43:54.119956Z"},{"id":"CLSA-2026-1792419628","title":"TuxCare security update for @react-router/node (1 CVE)","description":"TuxCare rebuilt @react-router/node to address 1 CVE. Fixed in 7.18.1-tuxcare.1.","status":"published","published":"2026-10-19T14:20:24Z","modified":"2026-10-19T19:15:17.440979106Z","updated_at":"2026-11-02T15:43:54.119956Z"},{"id":"CLSA-2026-1792421943","title":"TuxCare security update for @react-router/remix-routes-option-adapter (1 CVE)","description":"TuxCare rebuilt @react-router/remix-routes-option-adapter to address 1 CVE. Fixed in 7.5.1-tuxcare.7.","status":"published","published":"2026-10-19T14:59:00Z","modified":"2026-10-19T19:15:11.335293114Z","updated_at":"2026-11-02T15:43:54.119956Z"},{"id":"CLSA-2026-1792421948","title":"TuxCare security update for @react-router/remix-routes-option-adapter (1 CVE)","description":"TuxCare rebuilt @react-router/remix-routes-option-adapter to address 1 CVE. Fixed in 7.18.1-tuxcare.1.","status":"published","published":"2026-10-19T14:59:05Z","modified":"2026-10-19T19:15:19.236317982Z","updated_at":"2026-11-02T15:43:54.119956Z"},{"id":"CLSA-2026-1792424732","title":"TuxCare security update for @react-router/dev (1 CVE)","description":"TuxCare rebuilt @react-router/dev to address 1 CVE. Fixed in 7.5.1-tuxcare.7.","status":"published","published":"2026-10-19T15:45:29Z","modified":"2026-10-19T19:15:12.544812662Z","updated_at":"2026-11-02T15:43:54.119956Z"},{"id":"CLSA-2026-1792424737","title":"TuxCare security update for @react-router/dev (1 CVE)","description":"TuxCare rebuilt @react-router/dev to address 1 CVE. Fixed in 7.18.1-tuxcare.1.","status":"published","published":"2026-10-19T15:45:35Z","modified":"2026-10-19T19:15:19.749269831Z","updated_at":"2026-11-02T15:43:54.119956Z"},{"id":"CLSA-2026-1792425407","title":"TuxCare security update for @react-router/fs-routes (1 CVE)","description":"TuxCare rebuilt @react-router/fs-routes to address 1 CVE. Fixed in 7.5.1-tuxcare.7.","status":"published","published":"2026-10-19T15:56:44Z","modified":"2026-10-19T19:15:19.753663234Z","updated_at":"2026-11-02T15:43:54.119956Z"},{"id":"CLSA-2026-1792425410","title":"TuxCare security update for @react-router/fs-routes (1 CVE)","description":"TuxCare rebuilt @react-router/fs-routes to address 1 CVE. Fixed in 7.18.1-tuxcare.1.","status":"published","published":"2026-10-19T15:56:47Z","modified":"2026-10-19T19:15:12.229056549Z","updated_at":"2026-11-02T15:43:54.119956Z"},{"id":"CLSA-2026-1792428108","title":"TuxCare security update for @react-router/serve (1 CVE)","description":"TuxCare rebuilt @react-router/serve to address 1 CVE. Fixed in 7.5.1-tuxcare.7.","status":"published","published":"2026-10-19T16:41:46Z","modified":"2026-10-19T19:15:21.244961336Z","updated_at":"2026-11-02T15:43:54.119956Z"},{"id":"CLSA-2026-1792428114","title":"TuxCare security update for @react-router/serve (1 CVE)","description":"TuxCare rebuilt @react-router/serve to address 1 CVE. Fixed in 7.18.1-tuxcare.1.","status":"published","published":"2026-10-19T16:41:52Z","modified":"2026-10-19T19:15:22.138592846Z","updated_at":"2026-11-02T15:43:54.119956Z"},{"id":"CLSA-2026-1792430032","title":"TuxCare security update for create-react-router (1 CVE)","description":"TuxCare rebuilt create-react-router to address 1 CVE. Fixed in 7.5.1-tuxcare.7.","status":"published","published":"2026-10-19T17:13:49Z","modified":"2026-10-19T19:15:22.941327198Z","updated_at":"2026-11-02T15:43:54.119956Z"},{"id":"CLSA-2026-1792430036","title":"TuxCare security update for create-react-router (1 CVE)","description":"TuxCare rebuilt create-react-router to address 1 CVE. Fixed in 7.18.1-tuxcare.1.","status":"published","published":"2026-10-19T17:13:52Z","modified":"2026-10-19T19:15:23.942119192Z","updated_at":"2026-11-02T15:43:54.119956Z"},{"id":"CLSA-2026-1793099986","title":"TuxCare security update for react-router (3 CVEs)","description":"TuxCare rebuilt react-router to address 3 CVEs. Fixed in 7.14.1-tuxcare.2.","status":"published","published":"2026-10-27T11:19:46Z","modified":"2026-11-06T13:28:04.081316576Z","updated_at":"2026-11-06T13:44:09.891978Z"},{"id":"CLSA-2026-1793110184","title":"TuxCare security update for react-router (1 CVE)","description":"TuxCare rebuilt react-router to address 1 CVE. Fixed in 7.14.2-tuxcare.2.","status":"published","published":"2026-10-27T14:09:44Z","modified":"2026-11-06T13:28:02.527700936Z","updated_at":"2026-11-06T13:44:09.891978Z"},{"id":"CLSA-2026-1793125641","title":"TuxCare security update for react-router (1 CVE)","description":"TuxCare rebuilt react-router to address 1 CVE. Fixed in 7.13.1-tuxcare.3.","status":"published","published":"2026-10-27T18:27:21Z","modified":"2026-10-27T19:30:07.177900271Z","updated_at":"2026-11-02T15:43:55.34846Z"},{"id":"ROOT-APP-NPM-CVE-2026-55685","title":"CVE-2026-55685 in react-router - Patched by Root","description":"Root has patched CVE-2026-55685 in the react-router package for Root:npm. Multiple fixed versions available.","status":"published","published":"2026-08-11T12:47:31Z","modified":"2026-08-11T13:30:04.856266259Z","updated_at":"2026-11-02T15:53:27.649662Z"},{"id":"ROOT-APP-NPM-GHSA-qwww-vcr4-c8h2","title":"GHSA-qwww-vcr4-c8h2 in react-router - Patched by Root","description":"Root has patched GHSA-qwww-vcr4-c8h2 in the react-router package for Root:npm. Multiple fixed versions available.","status":"published","published":"2026-08-11T12:47:31Z","modified":"2026-08-11T13:30:03.416530776Z","updated_at":"2026-11-02T15:53:27.940619Z"}]}}