react-router vulnerabilities (npm)
19 vulnerabilities.
-
react-routernpm React Router: Unauthenticated Denial of Service via Inefficient Route Matching 8.7 High -
react-routernpm React Router: Open redirect via backslash in <Link> and useNavigate (CVE-2025-68470 bypass) 5.1 Medium -
react-routernpm React Router: Open redirect can lead to XSS 6.9 Medium -
react-routernpm React Router: Cross-site Scripting is Possible due to Missing RSCErrorHandler Protocol Validation (Incomplete fix for CVE-2026-53667) 6.9 Medium -
react-routernpm React Router: Arbitrary Constructor Injection via deserializeErrors() in React Router SSR Hydration 6.1 Medium -
react-routernpm React Router: `handleDocumentRequest` CSRF check covers `POST` only; PUT/PATCH/DELETE bypass 3.1 Low -
react-routernpm React Router vulnerable to DoS via unbounded path expansion in __manifest endpoint 7.5 High -
react-routernpm React Router's vendored turbo-stream v2 allows arbitrary constructor invocation via TYPE_ERROR deserialization leading to Unauth RCE 8.1 High -
react-routernpm React Router's same-origin redirect with path starting // causes open redirect via protocol-relative URL reinterpretation 6.6 Medium -
react-routernpm React Router vulnerable to Denial of Service via reflected user input in single-fetch 7.5 High -
react-routernpm React Router vulnerable to XSS in unstable RSC redirect handling via javascript: redirect targets 8.0 High -
react-routernpm React Router has stored XSS via unescaped Location header in prerendered redirect HTML 5.4 Medium -
react-routernpm React Router has CSRF issue in Action/Server Action Request Processing 6.5 Medium -
react-routernpm React Router vulnerable to XSS via Open Redirects 8.0 High -
react-routernpm React Router SSR XSS in ScrollRestoration 8.2 High -
react-routernpm React Router has unexpected external redirect via untrusted paths 6.5 Medium -
react-routernpm React Router has XSS Vulnerability 7.6 High -
react-routernpm React Router allows pre-render data spoofing on React-Router framework mode 8.2 High -
react-routernpm React Router allows a DoS via cache poisoning by forcing SPA mode 7.5 High