react-router-dom (npm)
Declarative routing for React
Advisories
3
Latest version
7.18.5
Released Oct 27, 2026
License
MIT
OpenSSF Scorecard
5.3 / 10
How to fix
Upgrading to 6.30.6 or later clears every advisory below that has a fix.
Upgrade commands
npm
npm install react-router-dom@7.18.5yarn
yarn add react-router-dom@7.18.5pnpm
pnpm add react-router-dom@7.18.5Known vulnerabilities
| Advisory | Severity | Affected | Fixed in |
|---|---|---|---|
| GHSA-jjmj-jmhj-qwj2 React Router: Open redirect leading to XSS |
Medium EPSS 0.34% |
>= 6.30.2, < 6.30.6 | 6.30.6 |
| GHSA-jjmj-jmhj-qwj2 React Router: Open redirect leading to XSS |
Medium EPSS 0.34% |
>= 6.30.2, <= 6.30.5 | No fix yet |
| MAL-2024-2936 Malicious code in react-router-dom (npm) Withdrawn |
Not rated yet | No fix yet |
Source: git+https://github.com/remix-run/react-router.git
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor