CVE-2026-53667

Fixed in a distro release EPSS <1%CVSS 6.9

React Router is a router for React. In versions 7.11.0 through 7.17.0, the RSCErrorHandler is missing protocol validation, allowing for redirects from untrusted sources. This issue is a follow up to CVE-2026-53667, and only affects consuming applications if they are using the unstable RSC APIs. This issue has been fixed in version 7.18.0.

Published 2026-07-27 · CVE record · OSV

Products: remix-run react-router

Fixed upstream

Distro releases