HighGHSA-rxv8-25v2-qmq8CVE-2026-34077

React Router vulnerable to Denial of Service via reflected user input in single-fetch

Published 4 Jun 2026 · Updated 4 Jun 2026

Affected packages

react-routernpm
Affected
>=7.0.0 <7.14.0
Fixed in
7.14.0
Update to the fixed version for your release line, for example:npm install react-router@7.14.0
turbo-streamnpm
Affected
<3.0.0
Fixed in
3.0.0
Update to the fixed version for your release line, for example:npm install turbo-stream@3.0.0

Details

A DoS vulnerability exists in the React Router v7 Framework Mode, as well as Remix v2.9.0+ with Single Fetch enabled. In some scenarios the underlying serialization algorithm can become a bottleneck when encoding specific types of data into server responses. Please upgrade to React Router v7.14.0 or later.

> [!NOTE] > This does not impact your React Router application if you are using Declarative Mode (<BrowserRouter>) or Data Mode (createBrowserRouter/<RouterProvider>).

Is GHSA-rxv8-25v2-qmq8 in any of your client repos?

Checking one package by hand is fine. Checking it across forty client projects is not. NPMscan reads the lockfiles in every GitHub repo you pick, finds each project with an affected react-router, and gives you the command that fixes it.

Scan a project free, no signupOr connect GitHub to scan every repo

References

Advisory data from OSV.dev (opens OSV.dev in a new tab), refreshed daily.