Is react-router 6.1 vulnerable?

npm · 2 releases from 6.1.0 to 6.1.1 · latest react-router is 8.5.1 · checked 1 Nov 2026

Yes: 2 known advisories

Yes. react-router 6.1.1, the last 6.1 release, is affected by 2 known security advisories (2 medium), including CVE-2026-53669, CVE-2025-68470. Upgrade to 7.18.0 or later to fix all of them.

Upgrade with:npm install react-router@7.18.0

Is your project affected?

Private repo? Upload its lockfile instead, or connect GitHub to check every repo.

Advisories affecting react-router 6.1.1

  • MediumCVE-2026-53669GHSA-wrjc-x8rr-h8h623 Jul 2026

    React Router: Open redirect via backslash in <Link> and useNavigate (CVE-2025-68470 bypass)

    Affected
    >=6.0.0 <7.18.0
    Fixed in
    7.18.0
  • MediumCVE-2025-68470GHSA-9jcx-v3wj-wh4m8 Jan 2026

    React Router has unexpected external redirect via untrusted paths

    Affected
    >=6.0.0 <6.30.2 · >=7.0.0 <7.9.6
    Fixed in
    6.30.2, 7.9.6

Which of your client projects are still on react-router 6.1?

NPMscan reads the lockfiles in every GitHub repo you pick, finds the exact react-router version each one installs, and checks it against these advisories. Each finding comes with the command that fixes it.

Scan a project free, no signupOr connect GitHub to scan every repo

Other react-router versions

Advisory data from OSV.dev (opens OSV.dev in a new tab), which includes the GitHub Advisory Database. Release list from the npm registry. Refreshed daily.