React Router discloses six vulnerabilities at once, led by an unauthenticated denial-of-service

React Router published six security advisories on July 22, including a high-severity flaw (CVE-2026-55685) that lets an unauthenticated request stall a Node server through the framework's manifest endpoint. The most serious fixes land in 7.18.0.

By Stackmaven

React Router, one of the most widely used routing libraries in the React ecosystem, published six security advisories on July 22. Five are rated Moderate and one is High: an unauthenticated denial-of-service in the framework’s internal manifest endpoint. If you run React Router in Framework Mode, this is a patch-now advisory rather than a read-later one, and the version that closes the most serious holes is 7.18.0.

What was disclosed

The batch, filed against the remix-run/react-router repository, spans the kinds of flaws that routing sits closest to: redirect handling, server-rendered error serialization, and request parsing. Two of the advisories carry confirmed CVE identifiers worth calling out by name.

The high-severity entry is CVE-2026-55685, an unauthenticated denial-of-service scored at CVSS 7.6, affecting React Router 7.0.0 through 7.17.x and patched in 7.18.0. The moderate entry with a public CVE is CVE-2026-53668, an open redirect that can lead to XSS, scored 6.9, which was fixed earlier in the 7.13.0 release and also touches the react-router-dom 6.30.x line that Remix v2 apps depend on.

The remaining four advisories are all rated Moderate: an RSC-mode CSRF bypass that allows an action to execute before a 400 response, an RSCErrorHandler that missed protocol validation and opened another XSS path, arbitrary client-side constructor injection through SSR hydration, and an unexpected external redirect via untrusted paths that bypasses the fix for an earlier issue (CVE-2025-68470). Several of these cluster around React Server Components handling, which is the newest and least battle-tested surface in the framework.

The denial-of-service is the one to move on first

The manifest flaw is the standout because it needs no authentication and no user interaction. React Router’s Framework Mode exposes an internal __manifest endpoint that the client uses to resolve routes. Per the advisory, deep, attacker-controlled paths can force expensive synchronous route matching against that endpoint, and because the matching runs on the main thread, it blocks the Node.js event loop. A single-threaded server that is busy matching a hostile path is a server that cannot answer anyone else, so a handful of crafted requests can degrade or stall an application without touching a login form.

Two scoping details matter for triage. First, the issue is specific to Framework Mode: apps using React Router in Declarative or Data mode are not affected by this particular flaw. Second, the endpoint is part of the framework’s own machinery, so there is no application code to audit and no feature flag to disable. The fix is the upgrade.

What to actually do

Move Framework Mode apps to React Router 7.18.0, which closes the denial-of-service along with the RSC-related XSS and hydration issues. If you are still on a 7.9 through 7.12 build, note that the open-redirect XSS was addressed back in 7.13.0, so a jump straight to 7.18.0 covers both waves. Remix v2 applications inherit the react-router-dom 6.30.x exposure for the open-redirect issue and should confirm they are on a patched dependency rather than assuming the Remix version alone protects them.

The practical read is that most of the severity here is concentrated in one flaw and one mode. A team on Declarative or Data mode can treat this as a routine maintenance upgrade. A team running Framework Mode with a public-facing server should treat the manifest DoS as time-sensitive, because the barrier to exploiting it is low and the effect is total unavailability rather than a scoped data leak.

The wider signal

Half of this batch lives in React Router’s Server Components surface, which is also the part of the framework that has changed most in the last year. That is the predictable cost of a fast-moving rendering model: new request paths, new serialization boundaries, and new redirect logic all arrive as fresh attack surface before the hardening catches up. React Router handling six coordinated disclosures in a single day is less a red flag about the library than a reminder that routing and RSC glue code deserve the same upgrade discipline teams already apply to their runtime. The next thing to watch is whether the RSC-adjacent advisories keep clustering as more apps ship Server Components in production. Stackmaven will check back on or around October 22.

Sources cited