CVE-2026-42342
Fixed in a distro release EPSS <1%CVSS 7.5
React Router is a router for React. In versions 7.0.0 through 7.14.x of react-router and versions 2.10.0 through 2.17.4 of @remix-run/server-runtime, certain crafted requests can consume disproportionate server resources via unbounded path expansion in the __manifest endpoint, resulting in response time degradation and/or service unavailability for end users. This affects React Router Framework Mode applications as well as Remix applications. This does not impact applications using Declarative Mode (`<BrowserRouter>`) or Data Mode (`createBrowserRouter/<RouterProvider>`). This is patched in react-router version 7.15.0 and @remix-run/server-runtime version 2.17.5.
Products: remix-run react-router, @remix-run/server-runtime
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| npm | @remix-run/server-runtime | 2.17.5 |
| npm | react-router | 7.15.0 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Chainguard | airflow-2 | no fix |
| Chainguard | airflow-core-2 | no fix |
| Chainguard | vitess-24 | 24.0.1-r2 |
| SUSE Linux Enterprise Module for Package Hub 15 SP7 | golang-github-prometheus-prometheus | 3.13.2-150100.4.40.2 |
| SUSE Multi Linux Manager Tools SLE-15 | golang-github-prometheus-prometheus | 3.13.2-150002.3.19.1 |
| SUSE Multi Linux Manager Tools SLE-15 | grafana | 12.4.10-150002.4.27.1 |
| SUSE Multi Linux Manager Tools SLE-15 | mgr-push | 5.2.5-150002.3.12.1 |
| SUSE Multi Linux Manager Tools SLE-15 | spacecmd | 5.2.10-150002.3.15.1 |
| SUSE Multi Linux Manager Tools SLE-15 | spacewalk-client-tools | 5.2.7-150002.3.12.1 |
| SUSE Multi Linux Manager Tools SLE-15 | uyuni-tools | 5.2.17-150002.3.20.1 |
| SUSE Multi Linux Manager Tools SLE-15 | venv-salt-minion | 3006.0-150002.5.22.1 |
| SUSE Multi Linux Manager Tools SLE-Micro-5 | uyuni-tools | 5.2.17-150002.3.20.1 |
| SUSE Multi Linux Manager Tools SLE-Micro-5 | venv-salt-minion | 3006.0-150002.5.22.1 |
| Wolfi | vitess-24 | 24.0.1-r2 |