@tanstack React-router vulnerabilities

• @tanstack react-router React Router: Unauthenticated Denial of Service via Inefficient Route Matching CVE-2026-55685 Fix available 8.7 HighJuly 24, 2026
• @tanstack react-router React Router: Open redirect via backslash in <Link> and useNavigate (CVE-2025-68470 bypass) CVE-2026-53669 Fix available 5.1 MediumJuly 23, 2026
• @tanstack react-router React Router: Open redirect can lead to XSS CVE-2026-53668 Fix available 6.9 MediumJuly 23, 2026
• @tanstack react-router React Router: Cross-site Scripting is Possible due to Missing RSCErrorHandler Protocol Validation (Incomplete fix for CVE-2026-53667) CVE-2026-53667 Fix available 6.9 MediumJuly 23, 2026
• @tanstack react-router React Router: Arbitrary Constructor Injection via deserializeErrors() in React Router SSR Hydration CVE-2026-53666 Fix available 6.1 MediumJuly 23, 2026
• @remix-run server-runtime, @tanstack react-router +1 more React Router: `handleDocumentRequest` CSRF check covers `POST` only; PUT/PATCH/DELETE bypass CVE-2026-53663 Fix available 3.1 LowJune 15, 2026
• @tanstack react-router, remix-run @remix-run/server-runtime, shopify remix-run\/server-runtime +2 more React Router vulnerable to DoS via unbounded path expansion in __manifest endpoint CVE-2026-42342 Fix available 7.5 HighJune 2, 2026
• @tanstack react-router React Router's vendored turbo-stream v2 allows arbitrary constructor invocation via TYPE_ERROR deserialization leading to Unauth RCE CVE-2026-42211 Fix available 8.1 HighJune 2, 2026
• @tanstack react-router, remix-run @remix-run/router +1 more React Router's same-origin redirect with path starting // causes open redirect via protocol-relative URL reinterpretation CVE-2026-40181 Fix available 6.6 MediumJune 2, 2026
• @tanstack react-router, remix-run turbo-stream, turbo-stream turbo stream +2 more React Router vulnerable to Denial of Service via reflected user input in single-fetch CVE-2026-34077 Fix available 7.5 HighJune 2, 2026
• @tanstack react-router React Router vulnerable to XSS in unstable RSC redirect handling via javascript: redirect targets CVE-2026-33245 Fix available 8.0 HighJune 2, 2026
• @tanstack react-router React Router has stored XSS via unescaped Location header in prerendered redirect HTML CVE-2026-33244 Fix available 5.4 MediumJune 2, 2026
• tanstack, @tanstack arktype-adapter, eslint-plugin-router +211 more +213 more Malware in 42 @tanstack/* packages exfiltrates cloud credentials, GitHub tokens, and SSH keys CVE-2026-45321 In KEVPublic exploitFix available 9.6 CriticalMay 12, 2026
• @clerk backend, nextjs, shared +31 more +33 more Clerk: Authorization bypass when combining organization, billing, or reverification checks CVE-2026-42349 Fix available 7.6 HighApril 30, 2026
• @tanstack react-router, shopify remix-run\/react +1 more React Router has CSRF issue in Action/Server Action Request Processing CVE-2026-22030 Fix available 6.5 MediumJanuary 8, 2026
• @tanstack react-router, remix-run @remix-run/router, red hat cryostat 4 +74 more +76 more React Router vulnerable to XSS via Open Redirects CVE-2026-22029 Fix available 8.0 HighJanuary 8, 2026
• @tanstack react-router, red hat ansible automation platform 2.6, ansible automation platform 2.6 for rhel 9 +6 more +8 more React Router SSR XSS in ScrollRestoration CVE-2026-21884 Fix available 8.2 HighJanuary 8, 2026
• @tanstack react-router React Router has unexpected external redirect via untrusted paths CVE-2025-68470 Fix available 6.5 MediumJanuary 8, 2026
• @tanstack react-router, red hat cryostat 4, gatekeeper 3 +47 more +49 more React Router has Path Traversal in File Session Storage CVE-2025-61686 Public exploitFix available EPSS 17.3% 9.1 CriticalJanuary 8, 2026
• @tanstack react-router, red hat ansible automation platform 2.6, ansible automation platform 2.6 for rhel 9 +6 more +8 more React Router has XSS Vulnerability CVE-2025-59057 Public exploitFix available 7.6 HighJanuary 8, 2026
• @tanstack react-router React Router allows pre-render data spoofing on React-Router framework mode CVE-2025-43865 Public exploitFix available 8.2 HighApril 24, 2025
• @tanstack react-router React Router allows a DoS via cache poisoning by forcing SPA mode CVE-2025-43864 Public exploitFix available EPSS 20.5% 7.5 HighApril 24, 2025
• @tanstack react-router Remix and React Router allow URL manipulation via Host / X-Forwarded-Host headers CVE-2025-31137 Public exploitFix available 7.5 HighApril 1, 2025