Potential Code Execution Vulnerability in React Router by Remix Run
CVE-2026-53666

6.1MEDIUM

Key Information:

Vendor

Remix-run

Status
React-router
Vendor
CVE Published:
27 July 2026

What is CVE-2026-53666?

In React Router versions ranging from 6.4.0 to 7.17.0, a vulnerability exists that permits attackers to exploit improperly handled input. If application developers fail to properly safeguard their SSR (Server-Side Rendering) code, an attacker can manipulate the input to trigger unexpected constructor behavior on the client side. This, in turn, can lead to unauthorized outbound network requests, posing a security risk. It is important to note that this vulnerability is exclusive to applications utilizing Framework Mode and Data Mode with manual SSR/hydration, and does not affect those using Declarative Mode. The issue has been addressed in version 7.18.0, so users are encouraged to upgrade to ensure their applications remain secure.

Affected Version(s)

react-router >= 6.4.0, < 7.18.0

References

https://github.com/remix-run/react-router/security/adviso...
x_refsource_CONFIRM
https://github.com/remix-run/react-router/pull/15175
x_refsource_MISC
https://github.com/remix-run/react-router/commit/9d22943f...
x_refsource_MISC

CVSS V3.1

Score:
6.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.