CVE-2026-55685
HIGHReact Router: Unauthenticated Denial of Service via Inefficient Route Matching
Title source: cnaDescription
React Router is a router for React. In versions 7.0.0 through 7.17.0, the manifest endpoint could be accessed via unauthenticated targeted requests that would put heavy load on the server and slow down response times. This issue is a follow up to CVE-2026-42342, and does not does not impact React Router applications using Declarative Mode (<BrowserRouter>) or Data Mode (createBrowserRouter/<RouterProvider>). This issue has been fixed in version 7.18.0.
References (6)
Core 6
Core References
X_Refsource_Confirm x_refsource_confirm
https://github.com/remix-run/react-router/security/advisories/GHSA-chx6-hx7r-mcp5
X_Refsource_Misc x_refsource_misc
https://github.com/remix-run/react-router/security/advisories/GHSA-8x6r-g9mw-2r78
X_Refsource_Misc x_refsource_misc
https://github.com/remix-run/react-router/pull/15186
X_Refsource_Misc x_refsource_misc
https://github.com/remix-run/react-router/commit/09e6020d1950e54f361f7ad00938ecd4dde60929
X_Refsource_Misc x_refsource_misc
https://github.com/remix-run/react-router/blob/main/CHANGELOG.md#v7180
X_Refsource_Misc x_refsource_misc
https://github.com/remix-run/react-router/releases/tag/[email protected]
Scores
CVSS v4
8.7
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Details
CWE
CWE-400
CWE-407
Status
published
Products (1)
remix-run/react-router
>= 7.0.0, < 7.18.0
Published
Jul 27, 2026
Tracked Since
Jul 28, 2026