Aller au contenu
en Se connecter
8.1 Élevée

CVE-2026-42211 React Router is a router for React

Description

React Router is a router for React. In versions 7.0.0 through 7.14.1, when using Framework Mode, a combination of steps could potentially allow unauthorized remote code execution (RCE) through external requests. This attack requires the application code to have an existing prototype pollution vulnerability, which can then be leveraged in a 2-step attack where the second step triggers unauthorized RCE on the remote server. This does not impact applications using Declarative Mode (`<BrowserRouter>`) or Data Mode (`createBrowserRouter/<RouterProvider>`). This is patched in version 7.14.2.

Produits et versions touchés

Produit Versions touchées Corrigé en
react-router 7.0 7.0.0 → < 7.14.2 7.14.2

Références

Chronologie

  1. Publiée
  2. Dernière modification

Autres CVE de react-router

Les 21 CVE de react-router →
CVE-2026-53669 React Router is a router for React 5.1 Moyenne CVE-2026-55685 React Router is a router for React 8.7 Élevée CVE-2026-53668 React Router is a router for React 6.9 Moyenne CVE-2026-53667 React Router is a router for React 6.9 Moyenne
Suivre cette CVE