react-router vulnerabilities
Declarative routing for React
- Registry
- npm
- Latest
- 8.5.0
- License
- MIT
20 known advisories
The latest version, 8.5.0, is not affected by any of them. Projects on older versions may be.
npm install react-router@8.5.0Security advisories for react-router
React Router: RSC Mode CSRF Bypass Allows Action Execution Before 400 Response
- Affected
- >=7.12.0 <7.18.2 · >=8.0.0 <8.3.0
- Fixed in
- 7.18.2, 8.3.0
React Router: Unauthenticated Denial of Service via Inefficient Route Matching
- Affected
- >=7.0.0 <7.18.0
- Fixed in
- 7.18.0
React Router: Open redirect via backslash in <Link> and useNavigate (CVE-2025-68470 bypass)
- Affected
- >=6.0.0 <7.18.0
- Fixed in
- 7.18.0
React Router: Open redirect leading to XSS
- Affected
- >=7.9.6 <7.13.0
- Fixed in
- 7.13.0
React Router: RSCErrorHandler Missing Protocol Validation (XSS)
- Affected
- >=7.11.0 <7.18.0
- Fixed in
- 7.18.0
React Router: Arbitrary Constructor Injection via deserializeErrors() in React Router SSR Hydration
- Affected
- >=6.4.0 <7.18.0
- Fixed in
- 7.18.0
React Router: Potential CSRF via PUT/PATCH/DELETE document requests
- Affected
- >=7.12.0 <7.15.1
- Fixed in
- 7.15.1
React Router vulnerable to Denial of Service via reflected user input in single-fetch
- Affected
- >=7.0.0 <7.14.0
- Fixed in
- 7.14.0
React Router vulnerable to DoS via unbounded path expansion in __manifest endpoint
- Affected
- >=7.0.0 <7.15.0
- Fixed in
- 7.15.0
React Router's vendored turbo-stream v2 allows arbitrary constructor invocation via TYPE_ERROR deserialization leading to Unauth RCE
- Affected
- >=7.0.0 <7.14.2
- Fixed in
- 7.14.2
React Router's same-origin redirect with path starting // causes open redirect via protocol-relative URL reinterpretation
- Affected
- >=7.0.0 <7.14.1 · >=6.7.0 <6.30.4
- Fixed in
- 6.30.4, 7.14.1
React Router vulnerable to XSS in unstable RSC redirect handling via javascript: redirect targets
- Affected
- >=7.7.0 <7.13.2
- Fixed in
- 7.13.2
React Router has stored XSS via unescaped Location header in prerendered redirect HTML
- Affected
- >=7.5.1 <7.13.2
- Fixed in
- 7.13.2
React Router has CSRF issue in Action/Server Action Request Processing
- Affected
- >=7.0.0 <7.12.0
- Fixed in
- 7.12.0
React Router vulnerable to XSS via Open Redirects
- Affected
- >=7.0.0 <7.12.0
- Fixed in
- 7.12.0
React Router SSR XSS in ScrollRestoration
- Affected
- >=7.0.0 <7.12.0
- Fixed in
- 7.12.0
React Router has unexpected external redirect via untrusted paths
- Affected
- >=6.0.0 <6.30.2 · >=7.0.0 <7.9.6
- Fixed in
- 6.30.2, 7.9.6
React Router has XSS Vulnerability
- Affected
- >=7.0.0 <7.9.0
- Fixed in
- 7.9.0
React Router allows pre-render data spoofing on React-Router framework mode
- Affected
- >=7.0.0-pre.0 <7.5.2
- Fixed in
- 7.5.2
React Router allows a DoS via cache poisoning by forcing SPA mode
- Affected
- >=7.2.0 <7.5.2
- Fixed in
- 7.5.2
Which of your client projects still run an old react-router?
NPMscan reads the package-lock.json, yarn.lock and pnpm-lock.yaml in every GitHub repo you pick and checks each installed version against these advisories, including the packages your packages pull in. Each finding comes with the command that fixes it.
Other npm packages
Advisory data from OSV.dev (opens OSV.dev in a new tab), refreshed daily. Package details from the npm registry.