CVE-2026-53669
Fixed in a distro release EPSS <1%CVSS 5.1
React Router is a router for React. Versions 6.0.0 through 7.17.0 are vulnerable to Open Redirtect through use of backslashes in <Link> and useNavigate. This issue is a follow up to CVE-2025-68470 and has been fixed in version 7.18.0.
Products: remix-run react-router
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| npm | react-router | 7.18.0 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Chainguard | airflow-2 | no fix |
| Chainguard | airflow-core-2 | no fix |
| Chainguard | keycloak-26.5 | 26.5.7-r3 |
| Chainguard | keycloak-26.5-iamguarded-compat | 26.5.7-r3 |
| Chainguard | keycloak-26.7 | 26.7.2-r1 |
| Chainguard | keycloak-26.7-iamguarded-compat | 26.7.2-r1 |
| Chainguard | librechat | 0.8.7-r7 |
| Chainguard | vitess-24 | 24.0.2-r7 |
| Chainguard | vitess-24-compat | 24.0.3-r7 |
| Red Hat hummingbird 1 | prometheus3.13 | 0:3.13.1-0.5.hum1 |
| Red Hat hummingbird 1 | prometheus3.5 | 0:3.5.5-0.6.hum1 |
| Wolfi | keycloak-26.5 | 26.5.7-r3 |
| Wolfi | keycloak-26.5-iamguarded-compat | 26.5.7-r3 |
| Wolfi | vitess-24 | 24.0.2-r7 |
| Wolfi | vitess-24-compat | 24.0.3-r7 |