---
title: "React Router security update: what you need to know"
description: "Multiple vulnerabilities have been disclosed in React Router. Affected projects should upgrade to 7.18.0 or later."
source: "https://www.netlify.com/changelog/2026-07-23-react-router-security-vulnerabilities/"
last_updated: "2026-07-23T23:29:42.000Z"
---
The React Router team has disclosed five security vulnerabilities affecting React Router. These issues are patched in React Router 7.18.0 (one issue was patched earlier, in 7.13.0). Here’s what Netlify customers need to know.

## Vulnerabilities

Vulnerability

CVE

Severity

Affected versions

Patched in

Open redirect leading to XSS

CVE-2026-53668

Medium

≥6.30.2 ≤6.30.4, ≥7.9.6 <7.13.0

7.13.0

Unauthenticated Denial of Service in React Router \_\_manifest endpoint

CVE-2026-55685

High

≥7.0.0 <7.18.0

7.18.0

RSCErrorHandler Missing Protocol Validation (XSS)

CVE-2026-53667

Medium

≥7.11.0 <7.18.0

7.18.0

Arbitrary client-side constructor injection via React Router SSR Hydration

CVE-2026-53666

Medium

≥6.4.0 <7.18.0

7.18.0

Unexpected external redirect via untrusted paths

CVE-2026-53669

Medium

≥6.0.0 <7.18

7.18.0

## Impact on Netlify

### Open redirect leading to XSS

Attacker-controlled redirect targets combined with path concatenation and `useNavigate` can escape the intended app path, resulting in open redirects or XSS via `javascript:` URLs. This affects Declarative, Data, and Framework mode apps that pass user-controlled values into navigation APIs.

**Regardless of hosting provider, all apps passing untrusted data into navigation APIs may be vulnerable.**

### Unauthenticated Denial of Service in React Router \_\_manifest endpoint

Deep, attacker-controlled paths can trigger expensive synchronous route matching, blocking the Node.js event loop with a single unauthenticated request to manifest endpoints (`__manifest`, and `*.manifest` in unstable RSC mode). This affects Framework mode with SSR only, including unstable RSC framework mode.

This is a server-side denial-of-service (DoS) vulnerability. **On Netlify, this has minimal impact**: our autoscaling serverless architecture means that a malicious request resulting in a crashed or hung function does not affect other requests. However, active exploitation could increase your function costs.

### RSCErrorHandler Missing Protocol Validation (XSS)

One RSC redirect handling path was missing protocol validation. Apps that redirect to attacker-controlled values may execute dangerous schemes such as `javascript:`. This only affects apps using unstable RSC Data or RSC Framework mode.

**Regardless of hosting provider, all RSC apps redirecting to untrusted values may be vulnerable.** Note that this affects an experimental feature only.

### Arbitrary client-side constructor injection via React Router SSR Hydration

Serialized server errors can carry a subtype that’s resolved against `window` during hydration. Apps that set user-controlled input into `error.name` could have this instantiate browser constructors such as `EventSource`, `WebSocket`, `Worker`, or `Image`. This affects Data and Framework mode SSR hydration.

**Regardless of hosting provider, apps setting user-controlled values into `error.name` may be vulnerable.** This requires an unusual application code path, so real-world impact is expected to be low.

### Unexpected external redirect via untrusted paths

Backslash-based URL forms such as `\\evil.com`, `/\evil.com`, or `\/evil.com` can be interpreted by browsers as cross-origin navigations, bypassing protections that only account for `//`. This affects `<Link>`, `useNavigate`, and redirects across Declarative, Data, Framework, and RSC modes.

**Regardless of hosting provider, all apps passing untrusted destinations to `<Link>`, `useNavigate`, or redirects may be vulnerable.**

## What should I do?

We strongly recommend upgrading as soon as possible to patched releases:

-   `react-router` 7.18.0 or later (all five issues)
-   `react-router` 7.13.0 or later addresses the open redirect leading to XSS issue only — upgrade to 7.18.0 for full coverage

Note that any publicly available deploy previews and branch deploys may remain vulnerable until they are [automatically deleted](https://docs.netlify.com/deploy/manage-deploys/manage-deploys-overview/#automatic-deploy-deletion). Consider [deleting these deploys manually](https://docs.netlify.com/deploy/manage-deploys/manage-deploys-overview/#manual-deploy-deletion-through-the-netlify-ui).

## Resources

-   [Open redirect leading to XSS (CVE-2026-53668)](https://github.com/remix-run/react-router/security/advisories/GHSA-jjmj-jmhj-qwj2)
-   [Unauthenticated Denial of Service in React Router \_\_manifest endpoint (CVE-2026-55685)](https://github.com/remix-run/react-router/security/advisories/GHSA-chx6-hx7r-mcp5)
-   [RSCErrorHandler Missing Protocol Validation (XSS) (CVE-2026-53667)](https://github.com/remix-run/react-router/security/advisories/GHSA-h8fp-f39c-q6mh)
-   [Arbitrary client-side constructor injection via React Router SSR Hydration (CVE-2026-53666)](https://github.com/remix-run/react-router/security/advisories/GHSA-337j-9hxr-rhxg)
-   [Unexpected external redirect via untrusted paths (CVE-2026-53669)](https://github.com/remix-run/react-router/security/advisories/GHSA-wrjc-x8rr-h8h6)