Shopify / React-Router
16 CVEs
| CVE ID | Description | Severity | CVSS | Published |
|---|---|---|---|---|
| CVE-2026-53669 | React Router: Open redirect via backslash in <Link> and useNavigate (CVE-2025-68470 bypass) | MEDIUM | 5.1 | Jul 27, 2026 |
| CVE-2026-55685 | React Router: Unauthenticated Denial of Service via Inefficient Route Matching | HIGH | 8.7 | Jul 27, 2026 |
| CVE-2026-53668 | React Router: Open redirect can lead to XSS | MEDIUM | 6.9 | Jul 27, 2026 |
| CVE-2026-53667 | React Router: Cross-site Scripting is Possible due to Missing RSCErrorHandler Protocol Validation (Incomplete fix for CVE-2026-53667) | MEDIUM | 6.9 | Jul 27, 2026 |
| CVE-2026-53666 | React Router: Arbitrary Constructor Injection via deserializeErrors() in React Router SSR Hydration | MEDIUM | 6.1 | Jul 27, 2026 |
| CVE-2026-42342 | React Router vulnerable to DoS via unbounded path expansion in __manifest endpoint | HIGH | 7.5 | Jun 2, 2026 |
| CVE-2026-42211 | React Router's vendored turbo-stream v2 allows arbitrary constructor invocation via TYPE_ERROR deserialization leading to Unauth RCE | HIGH | 8.1 | Jun 2, 2026 |
| CVE-2026-40181 | React Router's same-origin redirect with path starting // causes open redirect via protocol-relative URL reinterpretation | MEDIUM | 6.6 | Jun 2, 2026 |
| CVE-2026-34077 | React Router vulnerable to Denial of Service via reflected user input in single-fetch | HIGH | 7.5 | Jun 2, 2026 |
| CVE-2026-33245 | React Router vulnerable to XSS in unstable RSC redirect handling via javascript: redirect targets | HIGH | 8.0 | Jun 2, 2026 |
| CVE-2026-33244 | React Router has stored XSS via unescaped Location header in prerendered redirect HTML | MEDIUM | 5.4 | Jun 2, 2026 |
| CVE-2026-22030 | React Router has CSRF issue in Action/Server Action Request Processing | MEDIUM | 6.5 | Jan 10, 2026 |
| CVE-2026-22029 | React Router vulnerable to XSS via Open Redirects | HIGH | 8.0 | Jan 10, 2026 |
| CVE-2026-21884 | React Router SSR XSS in ScrollRestoration | HIGH | 8.2 | Jan 10, 2026 |
| CVE-2025-59057 | React Router has XSS Vulnerability | HIGH | 7.6 | Jan 10, 2026 |
| CVE-2025-68470 | React Router has unexpected external redirect via untrusted paths | MEDIUM | 6.5 | Jan 10, 2026 |
Showing 1 to 16 of 16 CVEs