React Router: Five Moderate Vulnerabilities Including Open Redirects and XSS Disclosed Together
Remix Run's React Router library was impacted by five moderate-severity vulnerabilities disclosed on July 27, 2026, including open redirects, XSS, and DoS risks.
Key findings
- Five moderate-severity vulnerabilities disclosed together for React Router on July 27, 2026.
- Vulnerabilities include open redirects, XSS via open redirects, and information disclosure.
- Denial-of-service risk identified in the @remix-run/server-runtime package.
- All disclosed vulnerabilities have been patched by the vendor.
- Users are urged to update React Router to the latest version.
On July 27, 2026, a batch of five moderate-severity vulnerabilities was disclosed for React Router, a popular routing library for React applications developed by Remix Run. These vulnerabilities, all disclosed within a one-hour window, highlight issues related to redirect handling, script execution, and information disclosure. The coordinated disclosure impacts users relying on React Router for client-side and server-side routing logic.
Several of the vulnerabilities stem from improper handling of redirects and navigation. CVE-2026-53669, an open redirect vulnerability, arises from the use of backslashes in navigation components. Similarly, CVE-2026-53667 addresses untrusted redirects due to missing protocol validation. These could allow attackers to craft malicious links that redirect users to unintended, potentially harmful websites.
Another significant finding is CVE-2026-53668, a Cross-Site Scripting (XSS) vulnerability that can be triggered via open redirects. This could enable attackers to inject malicious scripts into web pages viewed by users, potentially leading to session hijacking or other attacks. CVE-2026-53666 involves information disclosure through client-side constructor execution, which could expose sensitive data within the application's client-side environment.
Additionally, CVE-2026-55685 presents a denial-of-service (DoS) risk through unauthenticated requests to the manifest endpoint in the @remix-run/server-runtime package. This could allow unauthenticated attackers to disrupt the availability of applications relying on this component.
All five vulnerabilities were patched on the same day as their disclosure. Users are advised to update to the latest version of React Router to mitigate these risks. The coordinated nature of this disclosure suggests a thorough review of the library's security posture by the researchers or the vendor.
This batch of vulnerabilities underscores the importance of careful input validation and secure handling of navigation and redirects in web applications. Developers using React Router should ensure their applications are updated to the latest versions to protect against these potential security threats. The consistent moderate severity across all disclosed CVEs indicates a need for diligent security practices when integrating third-party libraries.