HighGHSA-2w69-qvjg-hvjxCVE-2026-22029

React Router vulnerable to XSS via Open Redirects

Published 8 Jan 2026 · Updated 3 Feb 2026

Affected packages

react-routernpm

Affected: >=7.0.0 <7.12.0
Fixed in: 7.12.0

Update to the fixed version for your release line, for example:npm install react-router@7.12.0

@remix-run/routernpm

Affected: <1.23.2
Fixed in: 1.23.2

Update to the fixed version for your release line, for example:npm install @remix-run/router@1.23.2

Details

React Router (and Remix v1/v2) SPA open navigation redirects originating from loaders or actions in Framework Mode, Data Mode, or the unstable RSC modes can result in unsafe URLs causing unintended javascript execution on the client. This is only an issue if developers are creating redirect paths from untrusted content or via an open redirect.

> [!NOTE] > This does not impact applications that use Declarative Mode (<BrowserRouter>).

Is GHSA-2w69-qvjg-hvjx in any of your client repos?

Checking one package by hand is fine. Checking it across forty client projects is not. NPMscan reads the lockfiles in every GitHub repo you pick, finds each project with an affected react-router, and gives you the command that fixes it.

Scan a project free, no signup Or connect GitHub to scan every repo

References

Advisory data from OSV.dev (opens OSV.dev in a new tab), refreshed daily.