We just published 6 CVEs identifying security vulnerabilities in...
React Router@ReactRouter
16 views
Jan 09, 2026
~1 min read
Advertisement
1
We just published 6 CVEs identifying security vulnerabilities in React Router and Remix v2
We recommend updating to the latest appropriate versions:
React Router v7 -- 7.12.0
React Router v6 -- 6.30.3
Remix v2 -- 2.17.2
Details, links, and package ranges are listed below
We recommend updating to the latest appropriate versions:
React Router v7 -- 7.12.0
React Router v6 -- 6.30.3
Remix v2 -- 2.17.2
Details, links, and package ranges are listed below
2
XSS via Meta component when generating script:ld+json tags
github.com/remix-run/reac…
Framework Mode only
Affected versions:
- @remix-run/react >=1.15.0, <=2.17.0
- react-router >=7.0.0, <=7.8.2
github.com/remix-run/reac…
Framework Mode only
Affected versions:
- @remix-run/react >=1.15.0, <=2.17.0
- react-router >=7.0.0, <=7.8.2
3
Unauthorized file access when using `createFileSessionStorage()` with unsigned cookies
github.com/remix-run/reac…
Framework Mode Only
Affected versions:
- @react-router/node >= 7.0.0, <=7.9.3
- @remix-run/deno <=2.17.1
- @remix-run/node <=2.17.1
github.com/remix-run/reac…
Framework Mode Only
Affected versions:
- @react-router/node >= 7.0.0, <=7.9.3
- @remix-run/deno <=2.17.1
- @remix-run/node <=2.17.1
4
Unexpected external redirect via untrusted paths
github.com/remix-run/reac…
Affected versions:
- react-router >=6.0.0,<=6.30.1
- react-router >=7.0.0,<=7.9.5
github.com/remix-run/reac…
Affected versions:
- react-router >=6.0.0,<=6.30.1
- react-router >=7.0.0,<=7.9.5
5
CSRF in React Router Action/Server Action Request Processing
github.com/remix-run/reac…
Framework Mode only
Affected versions:
- @remix-run/server-runtime <=2.17.2
- react-router >=7.0.0,<=7.11.0
github.com/remix-run/reac…
Framework Mode only
Affected versions:
- @remix-run/server-runtime <=2.17.2
- react-router >=7.0.0,<=7.11.0
6
XSS via Open Redirects
github.com/remix-run/reac…
Framework/Data mode only
Affected versions:
- @remix-run/router <=1.23.1
- react-router >=7.0.0,<=7.11.0
github.com/remix-run/reac…
Framework/Data mode only
Affected versions:
- @remix-run/router <=1.23.1
- react-router >=7.0.0,<=7.11.0
7
React Router SSR XSS in ScrollRestoration
github.com/remix-run/reac…
Framework Mode only
Affected versions:
- @remix-run/react <=2.17.2
- react-router >=7.0.0,<=7.11.0
github.com/remix-run/reac…
Framework Mode only
Affected versions:
- @remix-run/react <=2.17.2
- react-router >=7.0.0,<=7.11.0
