SB2026072295 - Multiple vulnerabilities in React Router

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2026072295

SB2026072295 - Multiple vulnerabilities in React Router

Published: July 22, 2026

Security Bulletin ID SB2026072295
CSH Severity
Medium
Patch available
YES
Number of vulnerabilities 4
Exploitation vector Remote access
Highest impact Code execution

Breakdown by Severity

Medium 50% Low 50%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 4 vulnerabilities.


1) Resource exhaustion (CVE-ID: CVE-2026-55685)

CWE-ID: CWE-400 - Resource exhaustion

CVSSv4: 5.4 [CVSS:4.0/AV:A/AC:L/AT:P/PR:L/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to cause a denial of service.

The vulnerability exists due to uncontrolled resource consumption in the __manifest endpoint when handling targeted unauthenticated requests. A remote user can send targeted requests to cause a denial of service.

Only Framework Mode applications are vulnerable.


2) Cross-site scripting (CVE-ID: CVE-2026-53667)

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVSSv4: 2.1 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]


The vulnerability allows a remote attacker to execute arbitrary script in the victim's browser.

The vulnerability exists due to improper input validation in the unstable RSC error handling path when processing redirects from untrusted sources. A remote attacker can supply a crafted redirect target to execute arbitrary script in the victim's browser.

This issue only affects applications using the unstable RSC APIs, and user interaction is required.


3) Input validation error (CVE-ID: CVE-2026-53666)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to trigger unexpected constructor execution on the client.

The vulnerability exists due to improper input validation in the SSR hydration process when processing attacker-supplied input that overwrites certain aspects of errors caught by SSR. A remote attacker can supply crafted input to trigger unexpected constructor execution on the client.

This only affects Framework Mode and Data Mode applications performing manual SSR and hydration, and does not impact Declarative Mode.


4) Open redirect (CVE-ID: CVE-2026-53669)

CWE-ID: CWE-601 - URL Redirection to Untrusted Site ('Open Redirect')

CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to redirect users to an external site.

The vulnerability exists due to open redirect in navigation mechanisms when processing attacker-supplied paths. A remote attacker can supply a crafted path to trigger an unexpected external navigation to redirect users to an external site.


Remediation

Install update from vendor's website.

References