Security Update: Multiple vulnerabilities in React Router

Netlify · 2026-07-23T11:45:06-0400

The React Router team has disclosed five security vulnerabilities affecting React Router. These issues are patched in React Router 7.18.0 (one issue was patched earlier, in 7.13.0). Here’s what Netlify customers need to know. Vulnerabilities Vulnerability: Open redirect leading to XSS CVE: CVE-2026-53668 Severity: Medium Affected versions: ≥6.30.2 ≤6.30.4, ≥7.9.6 \evil.com, or \/evil.com can be interpreted by browsers as cross-origin navigations, bypassing protections that only account for //. This affects <Link>, useNavigate, and redirects across Declarative, Data, Framework, and RSC modes. Regardless of hosting provider, all apps passing untrusted destinations to <Link>, useNavigate, or redirects may be vulnerable. What should I do? We strongly recommend upgrading as soon as possible to patched releases:

react-router 7.18.0 or later (all five issues)
react-router 7.13.0 or later addresses the open redirect leading to XSS issue only — upgrade to 7.18.0 for full coverage

Note that any publicly available deploy previews and branch deploys may remain vulnerable until they are automatically deleted. Consider deleting these deploys manually. Resources

Open redirect leading to XSS (CVE-2026-53668)
Unauthenticated Denial of Service in React Router __manifest endpoint (CVE-2026-55685)
RSCErrorHandler Missing Protocol Validation (XSS) (CVE-2026-53667)
Arbitrary client-side constructor injection via React Router SSR Hydration (CVE-2026-53666)
Unexpected external redirect via untrusted paths (CVE-2026-53669)