React Router 7.18.0 patches five vulnerabilities; DoS, XSS, open redirect

The React Router team has disclosed five security vulnerabilities affecting React Router. These issues are patched in React Router 7.18.0 (one issue was patched earlier, in 7.13.0). Here’s what Netlify customers need to know. Vulnerabilities Vulnerability: Open redirect leading to XSS CVE: CVE-2026-53668 Severity: Medium Affected versions: ≥6.30.2 ≤6.30.4, ≥7.9.6 <7.13.0 Patched in: 7.13.0 Vulnerability: Unauthenticated Denial of Service in React Router __manifest endpoint CVE: CVE-2026-55685 Severity: High Affected versions: ≥7.0.0 <7.18.0 Patched in: 7.18.0 Vulnerability: RSCErrorHandler Missing Protocol Validation (XSS) CVE: CVE-2026-53667 Severity: Medium Affected versions: ≥7.11.0 <7.18.0 Patched in: 7.18.0 Vulnerability: Arbitrary client-side constructor injection via React Router SSR Hydration CVE: CVE-2026-53666 Severity: Medium Affected versions: ≥6.4.0 <7.18.0 Patched in: 7.18.0 Vulnerability: Unexpected external redirect via untrusted paths CVE: CVE-2026-53669 Severity: Medium Affected versions: ≥6.0.0 <7.18 Patched in: 7.18.0 Impact on Netlify Open redirect leading to XSS Attacker-controlled redirect targets combined with path concatenation and useNavigate can escape the intended app path, resulting in open redirects or XSS via javascript: URLs. This affects Declarative, Data, and Framework mode apps that pass user-controlled values into navigation APIs. Regardless of hosting provider, all apps passing untrusted data into navigation APIs may be vulnerable. Unauthenticated Denial of Service in React Router __manifest endpoint Deep, attacker-controlled paths can trigger expensive synchronous route matching, blocking the Node.js event loop with a single unauthenticated request to manifest endpoints (__manifest, and *.manifest in unstable RSC mode). This affects Framework mode with SSR only, including unstable RSC framework mode. This is a server-side denial-of-service (DoS) vulnerability. On Netlify, this has minimal impact: our autoscaling serverless architecture means that a malicious request resulting in a crashed or hung function does not affect other requests. However, active exploitation could increase your function costs. RSCErrorHandler Missing Protocol Validation (XSS) One RSC redirect handling path was missing protocol validation. Apps that redirect to attacker-controlled values may execute dangerous schemes such as javascript:. This only affects apps using unstable RSC Data or RSC Framework mode. Regardless of hosting provider, all RSC apps redirecting to untrusted values may be vulnerable. Note that this affects an experimental feature only. Arbitrary client-side constructor injection via React Router SSR Hydration Serialized server errors can carry a subtype that’s resolved against window during hydration. Apps that set user-controlled input into error.name could have this instantiate browser constructors such as EventSource, WebSocket, Worker, or Image. This affects Data and Framework mode SSR hydration. Regardless of hosting provider, apps setting user-controlled values into error.name may be vulnerable. This requires an unusual application code path, so real-world impact is expected to be low. Unexpected external redirect via untrusted paths Backslash-based URL forms such as \\evil.com, /\evil.com, or \/evil.com can be interpreted by browsers as cross-origin navigations, bypassing protections that only account for //. This affects , useNavigate, and redirects across Declarative, Data, Framework, and RSC modes. Regardless of hosting provider, all apps passing untrusted destinations to , useNavigate, or redirects may be vulnerable. What should I do? We strongly recommend upgrading as soon as possible to patched releases:

• react-router 7.18.0 or later (all five issues)
• react-router 7.13.0 or later addresses the open redirect leading to XSS issue only — upgrade to 7.18.0 for full coverage

Note that any publicly available deploy previews and branch deploys may remain vulnerable until they are automatically deleted. Consider deleting these deploys manually. Resources

• Open redirect leading to XSS (CVE-2026-53668)
• Unauthenticated Denial of Service in React Router __manifest endpoint (CVE-2026-55685)
• RSCErrorHandler Missing Protocol Validation (XSS) (CVE-2026-53667)
• Arbitrary client-side constructor injection via React Router SSR Hydration (CVE-2026-53666)
• Unexpected external redirect via untrusted paths (CVE-2026-53669)