Is react-router 7.12 vulnerable?
npm · 1 release from 7.12.0 to 7.12.0 · latest react-router is 8.5.1 · checked 1 Nov 2026
Yes: 13 known advisories
Yes. react-router 7.12.0, the last 7.12 release, is affected by 13 known security advisories (6 high, 6 medium, 1 low), including CVE-2026-55685, CVE-2026-34077, CVE-2026-42342. Upgrade to 7.18.2 or later to fix all of them.
npm install react-router@7.18.2Advisories affecting react-router 7.12.0
React Router: RSC Mode CSRF Bypass Allows Action Execution Before 400 Response
- Affected
- >=7.12.0 <7.18.2 · >=8.0.0 <8.3.0
- Fixed in
- 7.18.2, 8.3.0
React Router: Unauthenticated Denial of Service via Inefficient Route Matching
- Affected
- >=7.0.0 <7.18.0
- Fixed in
- 7.18.0
React Router: Open redirect via backslash in <Link> and useNavigate (CVE-2025-68470 bypass)
- Affected
- >=6.0.0 <7.18.0
- Fixed in
- 7.18.0
React Router: Open redirect leading to XSS
- Affected
- >=7.9.6 <7.13.0
- Fixed in
- 7.13.0
React Router: RSCErrorHandler Missing Protocol Validation (XSS)
- Affected
- >=7.11.0 <7.18.0
- Fixed in
- 7.18.0
React Router: Arbitrary Constructor Injection via deserializeErrors() in React Router SSR Hydration
- Affected
- >=6.4.0 <7.18.0
- Fixed in
- 7.18.0
React Router: Potential CSRF via PUT/PATCH/DELETE document requests
- Affected
- >=7.12.0 <7.15.1
- Fixed in
- 7.15.1
React Router vulnerable to Denial of Service via reflected user input in single-fetch
- Affected
- >=7.0.0 <7.14.0
- Fixed in
- 7.14.0
React Router vulnerable to DoS via unbounded path expansion in __manifest endpoint
- Affected
- >=7.0.0 <7.15.0
- Fixed in
- 7.15.0
React Router's vendored turbo-stream v2 allows arbitrary constructor invocation via TYPE_ERROR deserialization leading to Unauth RCE
- Affected
- >=7.0.0 <7.14.2
- Fixed in
- 7.14.2
React Router's same-origin redirect with path starting // causes open redirect via protocol-relative URL reinterpretation
- Affected
- >=7.0.0 <7.14.1 · >=6.7.0 <6.30.4
- Fixed in
- 6.30.4, 7.14.1
React Router vulnerable to XSS in unstable RSC redirect handling via javascript: redirect targets
- Affected
- >=7.7.0 <7.13.2
- Fixed in
- 7.13.2
React Router has stored XSS via unescaped Location header in prerendered redirect HTML
- Affected
- >=7.5.1 <7.13.2
- Fixed in
- 7.13.2
Which of your client projects are still on react-router 7.12?
NPMscan reads the lockfiles in every GitHub repo you pick, finds the exact react-router version each one installs, and checks it against these advisories. Each finding comes with the command that fixes it.
Other react-router versions
Advisory data from OSV.dev (opens OSV.dev in a new tab), which includes the GitHub Advisory Database. Release list from the npm registry. Refreshed daily.