React Router patches a High-severity DoS in a five-CVE batch, and the framework-mode server surface keeps generating them

React Router disclosed five CVEs on July 22, 2026, patched across the 7.x line and cleared by upgrading to 7.18.0. The headline flaw is an unauthenticated denial of service rated High, CVSS 7.6, but the more telling detail is where all five sit: in the server behavior that Framework Mode added to what began as a client-side router. That surface has now produced three separate advisory batches this year.

What the advisories cover

The severe one is CVE-2026-55685 (GHSA-chx6-hx7r-mcp5). In Framework Mode, the __manifest endpoint can be hit by unauthenticated, targeted requests that force expensive synchronous route matching against deep, attacker-controlled paths, blocking the Node.js event loop and slowing the whole server. It affects React Router from 7.0.0 up to 7.18.0, is patched in 7.18.0, and, importantly, does not touch apps running in Declarative or Data mode. The advisory notes it is a follow-up to an earlier resource-exhaustion fix, which is its own signal about how hard this class of bug is to fully close.

The other four are Medium. Two are redirect problems that can escalate: an open redirect that reaches cross-site scripting through useNavigate and path concatenation, letting a crafted target escape the intended app path into a javascript: URL (CVE-2026-53668, patched in 7.13.0), and an external-redirect bypass where backslash forms such as \\evil.com or /\evil.com get read by browsers as cross-origin navigations (CVE-2026-53669). The remaining two live in server-component error handling: a missing protocol check on one RSC redirect path (CVE-2026-53667) and an arbitrary client-side constructor injection, where a serialized server error carries a subtype that gets resolved against window during hydration and can instantiate browser constructors (CVE-2026-53666). The redirect and hydration issues reach back into late 6.x releases; the clean line is 7.18.0, which closes all five.

Why the framework surface is where they land

None of these is a client-router bug in the old sense. React Router spent years as a library that mapped URLs to components in the browser. Framework Mode turned it into something that runs on the server: a manifest endpoint, server-side route matching, RSC error serialization, redirect handling in the request path. Every one of this batch lives in that added surface, and it is the same surface that produced the January and June 2026 advisory sets. The pattern worth naming is not that React Router is uniquely fragile, but that adopting its framework features means adopting a server security profile, with the DoS, redirect, and deserialization concerns that come with any server that parses untrusted input.

For a working developer, the consequence is concrete and immediate. If you run React Router in Framework Mode on a version below 7.18.0, the denial of service is reachable by anyone who can send an HTTP request, no login required, and it degrades the whole process rather than one route. The redirect and XSS issues are lower severity but classic phishing and session-theft primitives. The fix is a single dependency bump to 7.18.0, and there is no configuration workaround that substitutes for it. Teams still on 6.x should read the advisories for their exact line, since several issues span both major versions.

What’s worth watching

1. Whether 7.18.0 actually closes the DoS class. The manifest denial of service is explicitly a follow-up to a prior fix. A third round on the same endpoint would suggest the synchronous matching path needs a structural change, not another patch.
2. How fast the ecosystem picks up the bump. React Router is a transitive dependency in a large share of the React app ecosystem, and it already showed up bundled in enterprise products flagged by their own vendors. The gap between the advisory and real-world patch rates is where the DoS stays exploitable.
3. Whether framework-mode adopters treat it as server code. The durable lesson is that flipping on Framework Mode changes the threat model. Teams that moved for the data and routing ergonomics should be putting the server surface under the same input-validation and rate-limiting scrutiny they give any other public endpoint.

The upgrade itself is undramatic: move to React Router 7.18.0 and the batch is closed. The more durable takeaway is that a router that now runs on the server carries a server’s risk profile, and the recurring advisories are the cost of that shift rather than a run of bad luck. Stackmaven will revisit whether the framework-mode surface produces another batch on or around October 21.

Sources cited

1. GHSA-chx6-hx7r-mcp5: Unauthenticated Denial of Service in React Router (CVE-2026-55685, CVSS 7.6) github.com
2. Netlify: Security Update, Multiple vulnerabilities in React Router www.netlify.com