Is react-router 6.5 vulnerable?
npm · 1 release from 6.5.0 to 6.5.0 · latest react-router is 8.5.1 · checked 1 Nov 2026
Yes: 3 known advisories
Yes. react-router 6.5.0, the last 6.5 release, is affected by 3 known security advisories (3 medium), including CVE-2026-53669, CVE-2026-53666, CVE-2025-68470. Upgrade to 7.18.0 or later to fix all of them.
npm install react-router@7.18.0Advisories affecting react-router 6.5.0
React Router: Open redirect via backslash in <Link> and useNavigate (CVE-2025-68470 bypass)
- Affected
- >=6.0.0 <7.18.0
- Fixed in
- 7.18.0
React Router: Arbitrary Constructor Injection via deserializeErrors() in React Router SSR Hydration
- Affected
- >=6.4.0 <7.18.0
- Fixed in
- 7.18.0
React Router has unexpected external redirect via untrusted paths
- Affected
- >=6.0.0 <6.30.2 · >=7.0.0 <7.9.6
- Fixed in
- 6.30.2, 7.9.6
Which of your client projects are still on react-router 6.5?
NPMscan reads the lockfiles in every GitHub repo you pick, finds the exact react-router version each one installs, and checks it against these advisories. Each finding comes with the command that fixes it.
Other react-router versions
Advisory data from OSV.dev (opens OSV.dev in a new tab), which includes the GitHub Advisory Database. Release list from the npm registry. Refreshed daily.