Skip to content
fr Sign in
8.7 High

CVE-2026-55685 React Router is a router for React

Description

React Router is a router for React. In versions 7.0.0 through 7.17.0, the manifest endpoint could be accessed via unauthenticated targeted requests that would put heavy load on the server and slow down response times. This issue is a follow up to CVE-2026-42342, and does not does not impact React Router applications using Declarative Mode (<BrowserRouter>) or Data Mode (createBrowserRouter/<RouterProvider>). This issue has been fixed in version 7.18.0.

Affected products and versions

Product Affected versions Fixed in
react-router 7.0 7.0.0 → < 7.18.0 7.18.0

References

Timeline

  1. Published
  2. Last modified

Other CVEs of react-router

The 21 CVEs of react-router →
CVE-2026-53669 React Router is a router for React 5.1 Medium CVE-2026-53668 React Router is a router for React 6.9 Medium CVE-2026-53667 React Router is a router for React 6.9 Medium CVE-2026-53666 React Router is a router for React 6.1 Medium
Track this CVE