Posts tagged "Framework"

The React Router team has disclosed five security vulnerabilities affecting React Router. These issues are patched in React Router 7.18.0 (one issue was patched earlier, in 7.13.0). Here’s what Netlify customers need to know.

Vulnerabilities

Impact on Netlify

Open redirect leading to XSS

Attacker-controlled redirect targets combined with path concatenation and useNavigate can escape the intended app path, resulting in open redirects or XSS via javascript: URLs. This affects Declarative, Data, and Framework mode apps that pass user-controlled values into navigation APIs.

Regardless of hosting provider, all apps passing untrusted data into navigation APIs may be vulnerable.

Unauthenticated Denial of Service in React Router __manifest endpoint

Deep, attacker-controlled paths can trigger expensive synchronous route matching, blocking the Node.js event loop with a single unauthenticated request to manifest endpoints (__manifest, and *.manifest in unstable RSC mode). This affects Framework mode with SSR only, including unstable RSC framework mode.

This is a server-side denial-of-service (DoS) vulnerability. On Netlify, this has minimal impact: our autoscaling serverless architecture means that a malicious request resulting in a crashed or hung function does not affect other requests. However, active exploitation could increase your function costs.

RSCErrorHandler Missing Protocol Validation (XSS)

One RSC redirect handling path was missing protocol validation. Apps that redirect to attacker-controlled values may execute dangerous schemes such as javascript:. This only affects apps using unstable RSC Data or RSC Framework mode.

Regardless of hosting provider, all RSC apps redirecting to untrusted values may be vulnerable. Note that this affects an experimental feature only.

Arbitrary client-side constructor injection via React Router SSR Hydration

Serialized server errors can carry a subtype that’s resolved against window during hydration. Apps that set user-controlled input into error.name could have this instantiate browser constructors such as EventSource, WebSocket, Worker, or Image. This affects Data and Framework mode SSR hydration.

Regardless of hosting provider, apps setting user-controlled values into error.name may be vulnerable. This requires an unusual application code path, so real-world impact is expected to be low.

Unexpected external redirect via untrusted paths

Backslash-based URL forms such as \\evil.com, /\evil.com, or \/evil.com can be interpreted by browsers as cross-origin navigations, bypassing protections that only account for //. This affects <Link>, useNavigate, and redirects across Declarative, Data, Framework, and RSC modes.

Regardless of hosting provider, all apps passing untrusted destinations to <Link>, useNavigate, or redirects may be vulnerable.

What should I do?

We strongly recommend upgrading as soon as possible to patched releases:

• react-router 7.18.0 or later (all five issues)
• react-router 7.13.0 or later addresses the open redirect leading to XSS issue only — upgrade to 7.18.0 for full coverage

Note that any publicly available deploy previews and branch deploys may remain vulnerable until they are automatically deleted. Consider deleting these deploys manually.

Resources

• Open redirect leading to XSS (CVE-2026-53668)
• Unauthenticated Denial of Service in React Router __manifest endpoint (CVE-2026-55685)
• RSCErrorHandler Missing Protocol Validation (XSS) (CVE-2026-53667)
• Arbitrary client-side constructor injection via React Router SSR Hydration (CVE-2026-53666)
• Unexpected external redirect via untrusted paths (CVE-2026-53669)

Astro 7 is out today, and it just works on Netlify on day one. To upgrade, run:

npx @astrojs/upgrade

This will update Astro, the Netlify adapter, and all other official integrations together. You can also check out the official migration guide.

What’s new

Some highlights include:

• Vite 8 — Astro 7 upgrades to Vite 8, bringing faster builds and improved dev tooling.
• Sätteri is now the default markdown processor — Astro’s new native markdown pipeline replaces remark/rehype as the default. If your project uses remark or rehype plugins, you’ll need to install @astrojs/markdown-remark separately to keep them working.
• Advanced routing is stable — Previously behind an experimental flag, advanced routing is now enabled by default. The default entry point has moved from src/app.ts to src/fetch.ts.
• Streaming rendering is stable — The streaming-based rendering engine is now the default, replacing the legacy queued approach.
• Background dev server for AI coding agents — astro dev now detects AI coding environments and runs as a background process automatically. New astro dev stop, astro dev status, and astro dev logs commands let you manage it directly.
• Astro DB is deprecated — The astro db, astro login, astro logout, astro link, and astro init CLI commands have been removed. Switch to a dedicated database client.
• Custom logger is stable — context.logger is now always available in API routes and middleware, with built-in json, node, and console handlers.

Check the full upgrade guide for all the details.

Watch out for the new markdown defaults

If your site uses remark or rehype plugins, you’ll need to take action before upgrading. In Astro 7, the default markdown pipeline is Sätteri — Astro’s own native processor. The remark/rehype pipeline is no longer included by default.

To keep your existing plugins working, install the remark package separately:

npm install @astrojs/markdown-remark

Once installed, your existing markdown.remarkPlugins, markdown.rehypePlugins, and markdown.remarkRehype config options will continue to work as before. If you’re not using any remark or rehype plugins, no changes are needed — Sätteri handles standard Markdown out of the box.

Deploy an Astro 7 site on Netlify

If you want to get started with a new site, start with the Astro on Netlify doc, or just click this button:

React Router 8 was just released and is already supported on Netlify.

The breaking changes are largely limited to these new minimums:

• Node.js 22.22.0+
• React 19.2.7+
• Vite 7+

How to upgrade

To upgrade your existing Netlify project follow the React Router 8 upgrade guide and upgrade the Netlify React Router Vite plugin to v4.0.0+:

npm i @netlify/vite-plugin-react-router@latest

Try it now

To deploy a brand new, React Router 8 application to Netlify, click this button:

What you get

Full framework feature support, serverless and edge functions included, plus full Netlify platform emulation in local dev for you and your agents.

• React Router on Netlify
• @netlify/vite-plugin-react-router release notes

Angular v22 was released today and it is supported on Netlify on day one.

To upgrade, follow the Angular upgrade steps and update @netlify/angular-runtime to v4.0.0 or later.

Notable changes

• Minimum Node.js version: Angular v22 requires Node.js 22.12.0 or later. Make sure your Netlify site is configured to use a supported Node.js version.
• allowedHosts config: Angular v21.x (specifically, @angular/ssr) introduced an allowedHosts option in the AngularAppEngine configuration, giving you explicit control over which hosts are permitted to connect. Angular 22 started returning a HTTP 400 for requests with other host headers. @netlify/angular-runtime handles adding the most common URLs for a Netlify deploy to the allowedHosts config automatically allowing developers to use Netlify’s branch and deploy previews without the HTTP 400 error.
• Forwarded headers support withtrustProxyHeaders: A new trustProxyHeaders option lets Angular applications behind a reverse proxy correctly read forwarded headers such as X-Forwarded-For and X-Forwarded-Proto. @netlify/angular-runtime handles adding the required headers automatically.

Learn more:

• Angular v22 Release
• Angular on Netlify
• Angular Runtime

Shopify’s Hydrogen framework now works on Netlify with React Router 7 and Hydrogen 2026.1.0. The Netlify Hydrogen template has been fully rebuilt, and @netlify/vite-plugin-react-router now supports Hydrogen sites out of the box.

The updated template also comes with two meaningful improvements:

• Netlify Cache API integration — Data fetching is cached using the Netlify Cache API, giving you low-latency responses without extra configuration.
• Full local platform emulation — The Netlify Vite Plugin provides zero-config local emulation of Blobs, Functions, Edge Functions, and AI Gateway during development, so what you test locally matches what runs in production.

To get started with a new Hydrogen site on Netlify, deploy the updated template:

To move an existing Hydrogen site over to Netlify, follow the How to deploy a Shopify Hydrogen storefront to Netlify guide.

Learn more:

• Hydrogen template on GitHub
• @netlify/vite-plugin-react-router v3.1.0 release notes
• How to deploy a Shopify Hydrogen storefront to Netlify

Astro 6 is out today, and it just works on Netlify on day one. To upgrade, run:

npx @astrojs/upgrade

This will update Astro, the Netlify adapter, and all other official integrations together.

What’s new

Some highlights include:

• Vite 7 and a redesigned dev server — Faster builds and a better dev server built from the ground up.
• Content Layer API — Legacy content collections are fully removed. All collections must now use the Content Layer API.
• Node 22 — Node 18 and 20 are no longer supported.

Check the full upgrade guide for all the details.

Watch out for import.meta.env

One change worth calling out: import.meta.env values are now always inlined at build time in Astro 6. This means if you were relying on import.meta.env to read environment variables at runtime in your server-side code, those values will be baked into your build output instead.

To read environment variables at runtime, use process.env instead:

- const apiKey = import.meta.env.API_KEY;
+ const apiKey = process.env.API_KEY;

This is especially important for secrets. If a secret is inlined into your server bundle, it’s no longer secret. The good news: Netlify’s smart secret scanning will automatically detect exposed secrets in your build output and fail the build before it goes live, so you’ll know right away if something slipped through.

Deploy an Astro 6 site on Netlify

If you want to get started with a new site, start with the Astro on Netlify doc, or just click this button:

The Svelte team has disclosed five CVEs affecting the Svelte and SvelteKit ecosystem. Here’s what Netlify customers need to know.

Vulnerabilities

• CVE-2026-22775: Memory/CPU exhaustion in devalue (5.1.0–5.6.1)
• CVE-2026-22774: Memory exhaustion in devalue (5.3.0–5.6.1)
• CVE-2026-22803: Server crash in @sveltejs/kit (2.49.0–2.49.4)
• CVE-2025-67647: Server crash and SSRF in @sveltejs/kit (2.44.0–2.49.4) and @sveltejs/adapter-node (2.19.0–2.49.4)
• CVE-2025-15265: XSS in svelte (5.46.0–5.46.3)

Impact on Netlify

CVE-2026-22775, CVE-2026-22774, and CVE-2026-22803

These are server-side denial-of-service (DoS) vulnerabilities. On Netlify, these have minimal impact: our autoscaling serverless architecture means that a malicious request resulting in a crashed or hung function does not affect other requests. However, active exploitation could increase your function costs.

In addition, note that only sites using the experimental Remote Functions feature are affected.

CVE-2025-67647

As above, this DoS vulnerability involves intentionally “crashing” a server. On Netlify, this has minimal impact.

The SSRF vulnerability affects a @sveltejs/adapter-node, which is not used by apps deployed to Netlify.

CVE-2025-15265

This is a client-side cross-site scripting (XSS) vulnerability. Regardless of hosting provider, all apps using the experimental hydratable with unsanitized user-controlled keys are vulnerable.

What should I do?

Although the impact to Netlify sites is limited in this case, we always strongly recommend upgrading as soon as possible to patched releases:

• devalue 5.6.2 or later
• @sveltejs/kit 2.49.5 or later
• @sveltejs/adapter-node 5.5.1 or later
• svelte 5.46.4 or later

Resources

• Svelte team disclosure

Angular v21 was released today and it is supported on Netlify on day one.

To upgrade, follow the Angular upgrade steps and update @netlify/angular-runtime to v3.0.1 or later.

Learn more:

• Angular v21 Release
• Angular on Netlify
• Angular Runtime

React Router 7 apps on Netlify are deployed to Serverless Functions by default. Now, you can choose to deploy your app to Edge Functions instead, bringing your page renders, data loaders, and actions closer to your users while lowering cold start times.

How to use it

1. Ensure you’re on version 7.9.0 or later of React Router:

npm install react-router@latest @react-router/node@latest @react-router/dev@latest

2. Update to the latest version of the Netlify React Router plugin:

npm install @netlify/vite-plugin-react-router@latest

3. Enable the new edge option in your vite.config.ts (or .js):

export default defineConfig({
  plugins: [
    reactRouter(),
    netlifyReactRouter({ edge: true }), // <- deploy to Edge Functions
    netlify(),
  ],
})

4. Finally, create a file at app/entry.server.tsx (or .jsx) containing this single line:

export { default } from 'virtual:netlify-server-entry'

On your next deploy, page renders, loaders, and actions will all run in an edge function.

When to use it

Choose Edge Functions when:

• You need minimal latency for your globally distributed users (edge functions run on the node closest to the user)
• You need to optimize cold starts (initialization is faster with the slim Deno edge runtime)
• Your data loaders and actions make requests to databases and APIs that are also globally distributed, or none at all
• You need to support very large request or response bodies (Serverless Functions have a 6 MB limit)

Choose Serverless Functions when:

• Your data loaders and actions make requests to databases or APIs that are centrally located (canceling out much of the benefit of edge compute)
• Your server-side code is CPU-intensive (Serverless Functions run on more powerful machines)
• You need longer execution times (Functions allow up to 30s clock time, while Edge Functions are limited to 50ms CPU time)
• You cannot use Edge Functions due to their runtime constraints or limitations

Next steps

• Create a new React Router 7 project with our template
• Read the Netlify React Router plugin docs for more details on deploying to the edge