react-router (npm)
Declarative routing for React
Advisories
45
Latest version
8.5.1
Released Oct 27, 2026
License
MIT
OpenSSF Scorecard
5.3 / 10
How to fix
Upgrading to 8.3.0 or later clears every advisory below that has a fix.
Upgrade commands
npm
npm install react-router@8.5.1yarn
yarn add react-router@8.5.1pnpm
pnpm add react-router@8.5.1Known vulnerabilities
| Advisory | Severity | Affected | Fixed in |
|---|---|---|---|
| GHSA-qwww-vcr4-c8h2 React Router: RSC Mode CSRF Bypass Allows Action Execution Before 400 Response |
High | >= 7.12.0, < 7.18.2 | 7.18.2 |
| GHSA-qwww-vcr4-c8h2 React Router: RSC Mode CSRF Bypass Allows Action Execution Before 400 Response |
High | >= 8.0.0, < 8.3.0 | 8.3.0 |
| GHSA-qwww-vcr4-c8h2 React Router: RSC Mode CSRF Bypass Allows Action Execution Before 400 Response |
High | >= 7.12.0, < 7.18.2 | 7.18.2 |
| GHSA-qwww-vcr4-c8h2 React Router: RSC Mode CSRF Bypass Allows Action Execution Before 400 Response |
High | >= 8.0.0, < 8.3.0 | 8.3.0 |
| GHSA-chx6-hx7r-mcp5 React Router: Unauthenticated Denial of Service via Inefficient Route Matching |
High EPSS 0.71% |
>= 7.0.0, < 7.18.0 | 7.18.0 |
| GHSA-chx6-hx7r-mcp5 React Router: Unauthenticated Denial of Service via Inefficient Route Matching |
High EPSS 0.71% |
>= 7.0.0, < 7.18.0 | 7.18.0 |
| GHSA-wrjc-x8rr-h8h6 React Router: Open redirect via backslash in <Link> and useNavigate (CVE-2025-68470 bypass) |
Medium EPSS 0.32% |
>= 6.0.0, < 7.18.0 | 7.18.0 |
| GHSA-wrjc-x8rr-h8h6 React Router: Open redirect via backslash in <Link> and useNavigate (CVE-2025-68470 bypass) |
Medium EPSS 0.32% |
>= 6.0.0, < 7.18.0 | 7.18.0 |
| GHSA-jjmj-jmhj-qwj2 React Router: Open redirect leading to XSS |
Medium EPSS 0.34% |
>= 7.9.6, <= 7.12.0 | No fix yet |
| GHSA-jjmj-jmhj-qwj2 React Router: Open redirect leading to XSS |
Medium EPSS 0.34% |
>= 7.9.6, < 7.13.0 | 7.13.0 |
| GHSA-h8fp-f39c-q6mh React Router: RSCErrorHandler Missing Protocol Validation (XSS) |
Medium EPSS 0.36% |
>= 7.11.0, < 7.18.0 | 7.18.0 |
| GHSA-h8fp-f39c-q6mh React Router: RSCErrorHandler Missing Protocol Validation (XSS) |
Medium EPSS 0.36% |
>= 7.11.0, < 7.18.0 | 7.18.0 |
| GHSA-337j-9hxr-rhxg React Router: Arbitrary Constructor Injection via deserializeErrors() in React Router SSR Hydration |
Medium EPSS 0.42% |
>= 6.4.0, < 7.18.0 | 7.18.0 |
| GHSA-337j-9hxr-rhxg React Router: Arbitrary Constructor Injection via deserializeErrors() in React Router SSR Hydration |
Medium EPSS 0.42% |
>= 6.4.0, < 7.18.0 | 7.18.0 |
| GHSA-84g9-w2xq-vcv6 React Router: Potential CSRF via PUT/PATCH/DELETE document requests |
Low EPSS 0.15% |
>= 7.12.0, < 7.15.1 | 7.15.1 |
| GHSA-84g9-w2xq-vcv6 React Router: Potential CSRF via PUT/PATCH/DELETE document requests |
Low EPSS 0.15% |
>= 7.12.0, < 7.15.1 | 7.15.1 |
| GHSA-8x6r-g9mw-2r78 React Router vulnerable to DoS via unbounded path expansion in __manifest endpoint |
High EPSS 0.71% |
>= 7.0.0, < 7.15.0 | 7.15.0 |
| GHSA-8x6r-g9mw-2r78 React Router vulnerable to DoS via unbounded path expansion in __manifest endpoint |
High EPSS 0.71% |
>= 7.0.0, < 7.15.0 | 7.15.0 |
| GHSA-49rj-9fvp-4h2h React Router's vendored turbo-stream v2 allows arbitrary constructor invocation via TYPE_ERROR deserialization leading to Unauth RCE |
High EPSS 0.42% |
>= 7.0.0, <= 7.14.1 | No fix yet |
| GHSA-49rj-9fvp-4h2h React Router's vendored turbo-stream v2 allows arbitrary constructor invocation via TYPE_ERROR deserialization leading to Unauth RCE |
High EPSS 0.42% |
>= 7.0.0, < 7.14.2 | 7.14.2 |
| GHSA-2j2x-hqr9-3h42 React Router's same-origin redirect with path starting // causes open redirect via protocol-relative URL reinterpretation |
Medium EPSS 0.22% |
>= 7.0.0, < 7.14.1 | 7.14.1 |
| GHSA-2j2x-hqr9-3h42 React Router's same-origin redirect with path starting // causes open redirect via protocol-relative URL reinterpretation |
Medium EPSS 0.22% |
>= 6.7.0, < 6.30.4 | 6.30.4 |
| GHSA-2j2x-hqr9-3h42 React Router's same-origin redirect with path starting // causes open redirect via protocol-relative URL reinterpretation |
Medium EPSS 0.22% |
>= 7.0.0, < 7.14.1 | 7.14.1 |
| GHSA-2j2x-hqr9-3h42 React Router's same-origin redirect with path starting // causes open redirect via protocol-relative URL reinterpretation |
Medium EPSS 0.22% |
>= 6.7.0, < 6.30.4 | 6.30.4 |
| GHSA-rxv8-25v2-qmq8 React Router vulnerable to Denial of Service via reflected user input in single-fetch |
High EPSS 0.29% |
>= 7.0.0, < 7.14.0 | 7.14.0 |
| GHSA-rxv8-25v2-qmq8 React Router vulnerable to Denial of Service via reflected user input in single-fetch |
High EPSS 0.29% |
>= 7.0.0, < 7.14.0 | 7.14.0 |
| GHSA-8646-j5j9-6r62 React Router vulnerable to XSS in unstable RSC redirect handling via javascript: redirect targets |
Medium EPSS 0.19% |
>= 7.7.0, < 7.13.2 | 7.13.2 |
| GHSA-8646-j5j9-6r62 React Router vulnerable to XSS in unstable RSC redirect handling via javascript: redirect targets |
Medium EPSS 0.19% |
>= 7.7.0, < 7.13.2 | 7.13.2 |
| GHSA-f22v-gfqf-p8f3 React Router has stored XSS via unescaped Location header in prerendered redirect HTML |
Medium EPSS 0.14% |
>= 7.5.1, < 7.13.2 | 7.13.2 |
| GHSA-f22v-gfqf-p8f3 React Router has stored XSS via unescaped Location header in prerendered redirect HTML |
Medium EPSS 0.14% |
>= 7.5.1, < 7.13.2 | 7.13.2 |
| GHSA-h5cw-625j-3rxh React Router has CSRF issue in Action/Server Action Request Processing |
Medium EPSS 0.19% |
>= 7.0.0, <= 7.11.0 | No fix yet |
| GHSA-h5cw-625j-3rxh React Router has CSRF issue in Action/Server Action Request Processing |
Medium EPSS 0.19% |
>= 7.0.0, < 7.12.0 | 7.12.0 |
| GHSA-2w69-qvjg-hvjx React Router vulnerable to XSS via Open Redirects |
Medium EPSS 0.87% |
>= 7.0.0, < 7.12.0 | 7.12.0 |
| GHSA-2w69-qvjg-hvjx React Router vulnerable to XSS via Open Redirects |
Medium EPSS 0.87% |
>= 7.0.0, <= 7.11.0 | No fix yet |
| GHSA-8v8x-cx79-35w7 React Router SSR XSS in ScrollRestoration |
High EPSS 0.53% |
>= 7.0.0, < 7.12.0 | 7.12.0 |
| GHSA-8v8x-cx79-35w7 React Router SSR XSS in ScrollRestoration |
High EPSS 0.53% |
>= 7.0.0, < 7.12.0 | 7.12.0 |
| GHSA-9jcx-v3wj-wh4m React Router has unexpected external redirect via untrusted paths |
Medium EPSS 0.49% |
>= 6.0.0, < 6.30.2 | 6.30.2 |
| GHSA-9jcx-v3wj-wh4m React Router has unexpected external redirect via untrusted paths |
Medium EPSS 0.49% |
>= 7.0.0, < 7.9.6 | 7.9.6 |
| GHSA-9jcx-v3wj-wh4m React Router has unexpected external redirect via untrusted paths |
Medium EPSS 0.49% |
>= 7.0.0, < 7.9.6 | 7.9.6 |
| GHSA-9jcx-v3wj-wh4m React Router has unexpected external redirect via untrusted paths |
Medium EPSS 0.49% |
>= 6.0.0, < 6.30.2 | 6.30.2 |
| GHSA-3cgp-3xvw-98x8 React Router has XSS Vulnerability |
High EPSS 0.50% |
>= 7.0.0, <= 7.8.2 | No fix yet |
| GHSA-3cgp-3xvw-98x8 React Router has XSS Vulnerability |
High EPSS 0.50% |
>= 7.0.0, < 7.9.0 | 7.9.0 |
| GHSA-cpj6-fhp6-mr6j React Router allows pre-render data spoofing on React-Router framework mode |
High EPSS 0.81% |
>= 7.0.0-pre.0, <= 7.5.1 | No fix yet |
| GHSA-cpj6-fhp6-mr6j React Router allows pre-render data spoofing on React-Router framework mode |
High EPSS 0.81% |
>= 7.0.0-pre.0, < 7.5.2 | 7.5.2 |
| GHSA-f46r-rw29-r322 React Router allows a DoS via cache poisoning by forcing SPA mode |
High EPSS 20.47% |
>= 7.2.0, < 7.5.2 | 7.5.2 |
Source: https://github.com/remix-run/react-router
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor