pwnmyvibecode_

React Router and Remix vulnerabilities and security advisories

The newest reviewed advisories for react-router, react-router-dom, @remix-run/node, @remix-run/server-runtime and @remix-run/react on npm. Each one shows which versions are affected, which version fixes it, and a prompt that has your AI agent check your project and upgrade only if it needs to.

Get an email when React Router and Remix has a new one

Email alerts are coming soon. This page updates every hour.

$ latest 21 · 12 critical, high or exploited

  • highJul 24, 2026

    React Router: RSC Mode CSRF Bypass Allows Action Execution Before 400 Response

    • react-router >= 7.12.0, < 7.18.2 · fixed in 7.18.2
    • react-router >= 8.0.0, < 8.3.0 · fixed in 8.3.0
    GHSA-qwww-vcr4-c8h2
    prompt for your AI agent
    paste into your agent
    A security advisory covers a package this project may use.

Advisory: GHSA-qwww-vcr4-c8h2, severity high
What it is: React Router: RSC Mode CSRF Bypass Allows Action Execution Before 400 Response
Affected packages:
- react-router: affected versions >= 7.12.0, < 7.18.2. Fixed in 7.18.2.
- react-router: affected versions >= 8.0.0, < 8.3.0. Fixed in 8.3.0.
Details: https://github.com/advisories/GHSA-qwww-vcr4-c8h2

Please:
1. Check package.json and the lockfile (package-lock.json, pnpm-lock.yaml, yarn.lock or bun.lock) for these packages, including copies pulled in by other dependencies, and tell me which versions are installed.
2. If none of them are installed, or every installed version is outside the affected ranges, say so and change nothing.
3. If an installed version is affected, upgrade it to the fixed version for its release line or later. When the package only comes in through another dependency, upgrade that dependency, or add an override or resolution if it has no fixed release yet.
4. If there is no fixed version, read the advisory and apply its workaround, or tell me the options.
5. Reinstall, run the build and the tests, and fix anything the upgrade breaks.
6. Tell me what you changed and which versions are installed now.
  • highJul 24, 2026

    React Router: Unauthenticated Denial of Service via Inefficient Route Matching

    • react-router >= 7.0.0, < 7.18.0 · fixed in 7.18.0
    GHSA-chx6-hx7r-mcp5CVE-2026-55685
    prompt for your AI agent
    paste into your agent
    A security advisory covers a package this project may use.

Advisory: GHSA-chx6-hx7r-mcp5 (CVE-2026-55685), severity high
What it is: React Router: Unauthenticated Denial of Service via Inefficient Route Matching
Affected packages:
- react-router: affected versions >= 7.0.0, < 7.18.0. Fixed in 7.18.0.
Details: https://github.com/advisories/GHSA-chx6-hx7r-mcp5

Please:
1. Check package.json and the lockfile (package-lock.json, pnpm-lock.yaml, yarn.lock or bun.lock) for these packages, including copies pulled in by other dependencies, and tell me which versions are installed.
2. If none of them are installed, or every installed version is outside the affected ranges, say so and change nothing.
3. If an installed version is affected, upgrade it to the fixed version for its release line or later. When the package only comes in through another dependency, upgrade that dependency, or add an override or resolution if it has no fixed release yet.
4. If there is no fixed version, read the advisory and apply its workaround, or tell me the options.
5. Reinstall, run the build and the tests, and fix anything the upgrade breaks.
6. Tell me what you changed and which versions are installed now.
  • mediumJul 23, 2026

    React Router: Open redirect via backslash in <Link> and useNavigate (CVE-2025-68470 bypass)

    • react-router >= 6.0.0, < 7.18.0 · fixed in 7.18.0
    GHSA-wrjc-x8rr-h8h6CVE-2026-53669
    prompt for your AI agent
    paste into your agent
    A security advisory covers a package this project may use.

Advisory: GHSA-wrjc-x8rr-h8h6 (CVE-2026-53669), severity medium
What it is: React Router: Open redirect via backslash in <Link> and useNavigate (CVE-2025-68470 bypass)
Affected packages:
- react-router: affected versions >= 6.0.0, < 7.18.0. Fixed in 7.18.0.
Details: https://github.com/advisories/GHSA-wrjc-x8rr-h8h6

Please:
1. Check package.json and the lockfile (package-lock.json, pnpm-lock.yaml, yarn.lock or bun.lock) for these packages, including copies pulled in by other dependencies, and tell me which versions are installed.
2. If none of them are installed, or every installed version is outside the affected ranges, say so and change nothing.
3. If an installed version is affected, upgrade it to the fixed version for its release line or later. When the package only comes in through another dependency, upgrade that dependency, or add an override or resolution if it has no fixed release yet.
4. If there is no fixed version, read the advisory and apply its workaround, or tell me the options.
5. Reinstall, run the build and the tests, and fix anything the upgrade breaks.
6. Tell me what you changed and which versions are installed now.
  • mediumJul 23, 2026

    React Router: Open redirect leading to XSS

    • react-router >= 7.9.6, <= 7.12.0 · fixed in 7.13.0
    • react-router-dom >= 6.30.2, <= 6.30.5 · fixed in 6.30.6
    GHSA-jjmj-jmhj-qwj2CVE-2026-53668
    prompt for your AI agent
    paste into your agent
    A security advisory covers a package this project may use.

Advisory: GHSA-jjmj-jmhj-qwj2 (CVE-2026-53668), severity medium
What it is: React Router: Open redirect leading to XSS
Affected packages:
- react-router: affected versions >= 7.9.6, <= 7.12.0. Fixed in 7.13.0.
- react-router-dom: affected versions >= 6.30.2, <= 6.30.5. Fixed in 6.30.6.
Details: https://github.com/advisories/GHSA-jjmj-jmhj-qwj2

Please:
1. Check package.json and the lockfile (package-lock.json, pnpm-lock.yaml, yarn.lock or bun.lock) for these packages, including copies pulled in by other dependencies, and tell me which versions are installed.
2. If none of them are installed, or every installed version is outside the affected ranges, say so and change nothing.
3. If an installed version is affected, upgrade it to the fixed version for its release line or later. When the package only comes in through another dependency, upgrade that dependency, or add an override or resolution if it has no fixed release yet.
4. If there is no fixed version, read the advisory and apply its workaround, or tell me the options.
5. Reinstall, run the build and the tests, and fix anything the upgrade breaks.
6. Tell me what you changed and which versions are installed now.
  • mediumJul 23, 2026

    React Router: RSCErrorHandler Missing Protocol Validation (XSS)

    • react-router >= 7.11.0, < 7.18.0 · fixed in 7.18.0
    GHSA-h8fp-f39c-q6mhCVE-2026-53667
    prompt for your AI agent
    paste into your agent
    A security advisory covers a package this project may use.

Advisory: GHSA-h8fp-f39c-q6mh (CVE-2026-53667), severity medium
What it is: React Router: RSCErrorHandler Missing Protocol Validation (XSS)
Affected packages:
- react-router: affected versions >= 7.11.0, < 7.18.0. Fixed in 7.18.0.
Details: https://github.com/advisories/GHSA-h8fp-f39c-q6mh

Please:
1. Check package.json and the lockfile (package-lock.json, pnpm-lock.yaml, yarn.lock or bun.lock) for these packages, including copies pulled in by other dependencies, and tell me which versions are installed.
2. If none of them are installed, or every installed version is outside the affected ranges, say so and change nothing.
3. If an installed version is affected, upgrade it to the fixed version for its release line or later. When the package only comes in through another dependency, upgrade that dependency, or add an override or resolution if it has no fixed release yet.
4. If there is no fixed version, read the advisory and apply its workaround, or tell me the options.
5. Reinstall, run the build and the tests, and fix anything the upgrade breaks.
6. Tell me what you changed and which versions are installed now.
  • mediumJul 23, 2026

    React Router: Arbitrary Constructor Injection via deserializeErrors() in React Router SSR Hydration

    • react-router >= 6.4.0, < 7.18.0 · fixed in 7.18.0
    GHSA-337j-9hxr-rhxgCVE-2026-53666
    prompt for your AI agent
    paste into your agent
    A security advisory covers a package this project may use.

Advisory: GHSA-337j-9hxr-rhxg (CVE-2026-53666), severity medium
What it is: React Router: Arbitrary Constructor Injection via deserializeErrors() in React Router SSR Hydration
Affected packages:
- react-router: affected versions >= 6.4.0, < 7.18.0. Fixed in 7.18.0.
Details: https://github.com/advisories/GHSA-337j-9hxr-rhxg

Please:
1. Check package.json and the lockfile (package-lock.json, pnpm-lock.yaml, yarn.lock or bun.lock) for these packages, including copies pulled in by other dependencies, and tell me which versions are installed.
2. If none of them are installed, or every installed version is outside the affected ranges, say so and change nothing.
3. If an installed version is affected, upgrade it to the fixed version for its release line or later. When the package only comes in through another dependency, upgrade that dependency, or add an override or resolution if it has no fixed release yet.
4. If there is no fixed version, read the advisory and apply its workaround, or tell me the options.
5. Reinstall, run the build and the tests, and fix anything the upgrade breaks.
6. Tell me what you changed and which versions are installed now.
  • lowJun 15, 2026

    React Router: Potential CSRF via PUT/PATCH/DELETE document requests

    • react-router >= 7.12.0, < 7.15.1 · fixed in 7.15.1
    • @remix-run/server-runtime >= 2.17.3, < 2.17.5 · fixed in 2.17.5
    GHSA-84g9-w2xq-vcv6CVE-2026-53663
    prompt for your AI agent
    paste into your agent
    A security advisory covers a package this project may use.

Advisory: GHSA-84g9-w2xq-vcv6 (CVE-2026-53663), severity low
What it is: React Router: Potential CSRF via PUT/PATCH/DELETE document requests
Affected packages:
- react-router: affected versions >= 7.12.0, < 7.15.1. Fixed in 7.15.1.
- @remix-run/server-runtime: affected versions >= 2.17.3, < 2.17.5. Fixed in 2.17.5.
Details: https://github.com/advisories/GHSA-84g9-w2xq-vcv6

Please:
1. Check package.json and the lockfile (package-lock.json, pnpm-lock.yaml, yarn.lock or bun.lock) for these packages, including copies pulled in by other dependencies, and tell me which versions are installed.
2. If none of them are installed, or every installed version is outside the affected ranges, say so and change nothing.
3. If an installed version is affected, upgrade it to the fixed version for its release line or later. When the package only comes in through another dependency, upgrade that dependency, or add an override or resolution if it has no fixed release yet.
4. If there is no fixed version, read the advisory and apply its workaround, or tell me the options.
5. Reinstall, run the build and the tests, and fix anything the upgrade breaks.
6. Tell me what you changed and which versions are installed now.
  • highJun 4, 2026

    React Router vulnerable to Denial of Service via reflected user input in single-fetch

    • react-router >= 7.0.0, < 7.14.0 · fixed in 7.14.0
    GHSA-rxv8-25v2-qmq8CVE-2026-34077
    prompt for your AI agent
    paste into your agent
    A security advisory covers a package this project may use.

Advisory: GHSA-rxv8-25v2-qmq8 (CVE-2026-34077), severity high
What it is: React Router vulnerable to Denial of Service via reflected user input in single-fetch
Affected packages:
- react-router: affected versions >= 7.0.0, < 7.14.0. Fixed in 7.14.0.
Details: https://github.com/advisories/GHSA-rxv8-25v2-qmq8

Please:
1. Check package.json and the lockfile (package-lock.json, pnpm-lock.yaml, yarn.lock or bun.lock) for these packages, including copies pulled in by other dependencies, and tell me which versions are installed.
2. If none of them are installed, or every installed version is outside the affected ranges, say so and change nothing.
3. If an installed version is affected, upgrade it to the fixed version for its release line or later. When the package only comes in through another dependency, upgrade that dependency, or add an override or resolution if it has no fixed release yet.
4. If there is no fixed version, read the advisory and apply its workaround, or tell me the options.
5. Reinstall, run the build and the tests, and fix anything the upgrade breaks.
6. Tell me what you changed and which versions are installed now.
  • highJun 3, 2026

    React Router vulnerable to DoS via unbounded path expansion in __manifest endpoint

    • react-router >= 7.0.0, < 7.15.0 · fixed in 7.15.0
    • @remix-run/server-runtime >= 2.10.0, < 2.17.5 · fixed in 2.17.5
    GHSA-8x6r-g9mw-2r78CVE-2026-42342
    prompt for your AI agent
    paste into your agent
    A security advisory covers a package this project may use.

Advisory: GHSA-8x6r-g9mw-2r78 (CVE-2026-42342), severity high
What it is: React Router vulnerable to DoS via unbounded path expansion in __manifest endpoint
Affected packages:
- react-router: affected versions >= 7.0.0, < 7.15.0. Fixed in 7.15.0.
- @remix-run/server-runtime: affected versions >= 2.10.0, < 2.17.5. Fixed in 2.17.5.
Details: https://github.com/advisories/GHSA-8x6r-g9mw-2r78

Please:
1. Check package.json and the lockfile (package-lock.json, pnpm-lock.yaml, yarn.lock or bun.lock) for these packages, including copies pulled in by other dependencies, and tell me which versions are installed.
2. If none of them are installed, or every installed version is outside the affected ranges, say so and change nothing.
3. If an installed version is affected, upgrade it to the fixed version for its release line or later. When the package only comes in through another dependency, upgrade that dependency, or add an override or resolution if it has no fixed release yet.
4. If there is no fixed version, read the advisory and apply its workaround, or tell me the options.
5. Reinstall, run the build and the tests, and fix anything the upgrade breaks.
6. Tell me what you changed and which versions are installed now.
  • highJun 3, 2026

    React Router's vendored turbo-stream v2 allows arbitrary constructor invocation via TYPE_ERROR deserialization leading to Unauth RCE

    • react-router >= 7.0.0, <= 7.14.1 · fixed in 7.14.2
    GHSA-49rj-9fvp-4h2hCVE-2026-42211
    prompt for your AI agent
    paste into your agent
    A security advisory covers a package this project may use.

Advisory: GHSA-49rj-9fvp-4h2h (CVE-2026-42211), severity high
What it is: React Router's vendored turbo-stream v2 allows arbitrary constructor invocation via TYPE_ERROR deserialization leading to Unauth RCE
Affected packages:
- react-router: affected versions >= 7.0.0, <= 7.14.1. Fixed in 7.14.2.
Details: https://github.com/advisories/GHSA-49rj-9fvp-4h2h

Please:
1. Check package.json and the lockfile (package-lock.json, pnpm-lock.yaml, yarn.lock or bun.lock) for these packages, including copies pulled in by other dependencies, and tell me which versions are installed.
2. If none of them are installed, or every installed version is outside the affected ranges, say so and change nothing.
3. If an installed version is affected, upgrade it to the fixed version for its release line or later. When the package only comes in through another dependency, upgrade that dependency, or add an override or resolution if it has no fixed release yet.
4. If there is no fixed version, read the advisory and apply its workaround, or tell me the options.
5. Reinstall, run the build and the tests, and fix anything the upgrade breaks.
6. Tell me what you changed and which versions are installed now.
  • mediumJun 3, 2026

    React Router's same-origin redirect with path starting // causes open redirect via protocol-relative URL reinterpretation

    • react-router >= 7.0.0, < 7.14.1 · fixed in 7.14.1
    • react-router >= 6.7.0, < 6.30.4 · fixed in 6.30.4
    GHSA-2j2x-hqr9-3h42CVE-2026-40181
    prompt for your AI agent
    paste into your agent
    A security advisory covers a package this project may use.

Advisory: GHSA-2j2x-hqr9-3h42 (CVE-2026-40181), severity medium
What it is: React Router's same-origin redirect with path starting // causes open redirect via protocol-relative URL reinterpretation
Affected packages:
- react-router: affected versions >= 7.0.0, < 7.14.1. Fixed in 7.14.1.
- react-router: affected versions >= 6.7.0, < 6.30.4. Fixed in 6.30.4.
Details: https://github.com/advisories/GHSA-2j2x-hqr9-3h42

Please:
1. Check package.json and the lockfile (package-lock.json, pnpm-lock.yaml, yarn.lock or bun.lock) for these packages, including copies pulled in by other dependencies, and tell me which versions are installed.
2. If none of them are installed, or every installed version is outside the affected ranges, say so and change nothing.
3. If an installed version is affected, upgrade it to the fixed version for its release line or later. When the package only comes in through another dependency, upgrade that dependency, or add an override or resolution if it has no fixed release yet.
4. If there is no fixed version, read the advisory and apply its workaround, or tell me the options.
5. Reinstall, run the build and the tests, and fix anything the upgrade breaks.
6. Tell me what you changed and which versions are installed now.
  • highJun 3, 2026

    React Router vulnerable to XSS in unstable RSC redirect handling via javascript: redirect targets

    • react-router >= 7.7.0, < 7.13.2 · fixed in 7.13.2
    GHSA-8646-j5j9-6r62CVE-2026-33245
    prompt for your AI agent
    paste into your agent
    A security advisory covers a package this project may use.

Advisory: GHSA-8646-j5j9-6r62 (CVE-2026-33245), severity high
What it is: React Router vulnerable to XSS in unstable RSC redirect handling via javascript: redirect targets
Affected packages:
- react-router: affected versions >= 7.7.0, < 7.13.2. Fixed in 7.13.2.
Details: https://github.com/advisories/GHSA-8646-j5j9-6r62

Please:
1. Check package.json and the lockfile (package-lock.json, pnpm-lock.yaml, yarn.lock or bun.lock) for these packages, including copies pulled in by other dependencies, and tell me which versions are installed.
2. If none of them are installed, or every installed version is outside the affected ranges, say so and change nothing.
3. If an installed version is affected, upgrade it to the fixed version for its release line or later. When the package only comes in through another dependency, upgrade that dependency, or add an override or resolution if it has no fixed release yet.
4. If there is no fixed version, read the advisory and apply its workaround, or tell me the options.
5. Reinstall, run the build and the tests, and fix anything the upgrade breaks.
6. Tell me what you changed and which versions are installed now.
  • mediumJun 3, 2026

    React Router has stored XSS via unescaped Location header in prerendered redirect HTML

    • react-router >= 7.5.1, < 7.13.2 · fixed in 7.13.2
    GHSA-f22v-gfqf-p8f3CVE-2026-33244
    prompt for your AI agent
    paste into your agent
    A security advisory covers a package this project may use.

Advisory: GHSA-f22v-gfqf-p8f3 (CVE-2026-33244), severity medium
What it is: React Router has stored XSS via unescaped Location header in prerendered redirect HTML
Affected packages:
- react-router: affected versions >= 7.5.1, < 7.13.2. Fixed in 7.13.2.
Details: https://github.com/advisories/GHSA-f22v-gfqf-p8f3

Please:
1. Check package.json and the lockfile (package-lock.json, pnpm-lock.yaml, yarn.lock or bun.lock) for these packages, including copies pulled in by other dependencies, and tell me which versions are installed.
2. If none of them are installed, or every installed version is outside the affected ranges, say so and change nothing.
3. If an installed version is affected, upgrade it to the fixed version for its release line or later. When the package only comes in through another dependency, upgrade that dependency, or add an override or resolution if it has no fixed release yet.
4. If there is no fixed version, read the advisory and apply its workaround, or tell me the options.
5. Reinstall, run the build and the tests, and fix anything the upgrade breaks.
6. Tell me what you changed and which versions are installed now.
  • mediumJan 8, 2026

    React Router has CSRF issue in Action/Server Action Request Processing

    • react-router >= 7.0.0, <= 7.11.0 · fixed in 7.12.0
    • @remix-run/server-runtime <= 2.17.2 · fixed in 2.17.3
    GHSA-h5cw-625j-3rxhCVE-2026-22030
    prompt for your AI agent
    paste into your agent
    A security advisory covers a package this project may use.

Advisory: GHSA-h5cw-625j-3rxh (CVE-2026-22030), severity medium
What it is: React Router has CSRF issue in Action/Server Action Request Processing
Affected packages:
- react-router: affected versions >= 7.0.0, <= 7.11.0. Fixed in 7.12.0.
- @remix-run/server-runtime: affected versions <= 2.17.2. Fixed in 2.17.3.
Details: https://github.com/advisories/GHSA-h5cw-625j-3rxh

Please:
1. Check package.json and the lockfile (package-lock.json, pnpm-lock.yaml, yarn.lock or bun.lock) for these packages, including copies pulled in by other dependencies, and tell me which versions are installed.
2. If none of them are installed, or every installed version is outside the affected ranges, say so and change nothing.
3. If an installed version is affected, upgrade it to the fixed version for its release line or later. When the package only comes in through another dependency, upgrade that dependency, or add an override or resolution if it has no fixed release yet.
4. If there is no fixed version, read the advisory and apply its workaround, or tell me the options.
5. Reinstall, run the build and the tests, and fix anything the upgrade breaks.
6. Tell me what you changed and which versions are installed now.
  • highJan 8, 2026

    React Router vulnerable to XSS via Open Redirects

    • react-router >= 7.0.0, <= 7.11.0 · fixed in 7.12.0
    GHSA-2w69-qvjg-hvjxCVE-2026-22029
    prompt for your AI agent
    paste into your agent
    A security advisory covers a package this project may use.

Advisory: GHSA-2w69-qvjg-hvjx (CVE-2026-22029), severity high
What it is: React Router vulnerable to XSS via Open Redirects
Affected packages:
- react-router: affected versions >= 7.0.0, <= 7.11.0. Fixed in 7.12.0.
Details: https://github.com/advisories/GHSA-2w69-qvjg-hvjx

Please:
1. Check package.json and the lockfile (package-lock.json, pnpm-lock.yaml, yarn.lock or bun.lock) for these packages, including copies pulled in by other dependencies, and tell me which versions are installed.
2. If none of them are installed, or every installed version is outside the affected ranges, say so and change nothing.
3. If an installed version is affected, upgrade it to the fixed version for its release line or later. When the package only comes in through another dependency, upgrade that dependency, or add an override or resolution if it has no fixed release yet.
4. If there is no fixed version, read the advisory and apply its workaround, or tell me the options.
5. Reinstall, run the build and the tests, and fix anything the upgrade breaks.
6. Tell me what you changed and which versions are installed now.
  • highJan 8, 2026

    React Router SSR XSS in ScrollRestoration

    • react-router >= 7.0.0, < 7.12.0 · fixed in 7.12.0
    • @remix-run/react < 2.17.3 · fixed in 2.17.3
    GHSA-8v8x-cx79-35w7CVE-2026-21884
    prompt for your AI agent
    paste into your agent
    A security advisory covers a package this project may use.

Advisory: GHSA-8v8x-cx79-35w7 (CVE-2026-21884), severity high
What it is: React Router SSR XSS in ScrollRestoration
Affected packages:
- react-router: affected versions >= 7.0.0, < 7.12.0. Fixed in 7.12.0.
- @remix-run/react: affected versions < 2.17.3. Fixed in 2.17.3.
Details: https://github.com/advisories/GHSA-8v8x-cx79-35w7

Please:
1. Check package.json and the lockfile (package-lock.json, pnpm-lock.yaml, yarn.lock or bun.lock) for these packages, including copies pulled in by other dependencies, and tell me which versions are installed.
2. If none of them are installed, or every installed version is outside the affected ranges, say so and change nothing.
3. If an installed version is affected, upgrade it to the fixed version for its release line or later. When the package only comes in through another dependency, upgrade that dependency, or add an override or resolution if it has no fixed release yet.
4. If there is no fixed version, read the advisory and apply its workaround, or tell me the options.
5. Reinstall, run the build and the tests, and fix anything the upgrade breaks.
6. Tell me what you changed and which versions are installed now.
  • mediumJan 8, 2026

    React Router has unexpected external redirect via untrusted paths

    • react-router >= 6.0.0, < 6.30.2 · fixed in 6.30.2
    • react-router >= 7.0.0, < 7.9.6 · fixed in 7.9.6
    GHSA-9jcx-v3wj-wh4mCVE-2025-68470
    prompt for your AI agent
    paste into your agent
    A security advisory covers a package this project may use.

Advisory: GHSA-9jcx-v3wj-wh4m (CVE-2025-68470), severity medium
What it is: React Router has unexpected external redirect via untrusted paths
Affected packages:
- react-router: affected versions >= 6.0.0, < 6.30.2. Fixed in 6.30.2.
- react-router: affected versions >= 7.0.0, < 7.9.6. Fixed in 7.9.6.
Details: https://github.com/advisories/GHSA-9jcx-v3wj-wh4m

Please:
1. Check package.json and the lockfile (package-lock.json, pnpm-lock.yaml, yarn.lock or bun.lock) for these packages, including copies pulled in by other dependencies, and tell me which versions are installed.
2. If none of them are installed, or every installed version is outside the affected ranges, say so and change nothing.
3. If an installed version is affected, upgrade it to the fixed version for its release line or later. When the package only comes in through another dependency, upgrade that dependency, or add an override or resolution if it has no fixed release yet.
4. If there is no fixed version, read the advisory and apply its workaround, or tell me the options.
5. Reinstall, run the build and the tests, and fix anything the upgrade breaks.
6. Tell me what you changed and which versions are installed now.
  • criticalJan 8, 2026

    React Router has Path Traversal in File Session Storage

    • @remix-run/node <= 2.17.1 · fixed in 2.17.2
    GHSA-9583-h5hc-x8cwCVE-2025-61686
    prompt for your AI agent
    paste into your agent
    A security advisory covers a package this project may use.

Advisory: GHSA-9583-h5hc-x8cw (CVE-2025-61686), severity critical
What it is: React Router has Path Traversal in File Session Storage
Affected packages:
- @remix-run/node: affected versions <= 2.17.1. Fixed in 2.17.2.
Details: https://github.com/advisories/GHSA-9583-h5hc-x8cw

Please:
1. Check package.json and the lockfile (package-lock.json, pnpm-lock.yaml, yarn.lock or bun.lock) for these packages, including copies pulled in by other dependencies, and tell me which versions are installed.
2. If none of them are installed, or every installed version is outside the affected ranges, say so and change nothing.
3. If an installed version is affected, upgrade it to the fixed version for its release line or later. When the package only comes in through another dependency, upgrade that dependency, or add an override or resolution if it has no fixed release yet.
4. If there is no fixed version, read the advisory and apply its workaround, or tell me the options.
5. Reinstall, run the build and the tests, and fix anything the upgrade breaks.
6. Tell me what you changed and which versions are installed now.
  • highJan 8, 2026

    React Router has XSS Vulnerability

    • react-router >= 7.0.0, <= 7.8.2 · fixed in 7.9.0
    • @remix-run/react >= 1.15.0, <= 2.17.0 · fixed in 2.17.1
    GHSA-3cgp-3xvw-98x8CVE-2025-59057
    prompt for your AI agent
    paste into your agent
    A security advisory covers a package this project may use.

Advisory: GHSA-3cgp-3xvw-98x8 (CVE-2025-59057), severity high
What it is: React Router has XSS Vulnerability
Affected packages:
- react-router: affected versions >= 7.0.0, <= 7.8.2. Fixed in 7.9.0.
- @remix-run/react: affected versions >= 1.15.0, <= 2.17.0. Fixed in 2.17.1.
Details: https://github.com/advisories/GHSA-3cgp-3xvw-98x8

Please:
1. Check package.json and the lockfile (package-lock.json, pnpm-lock.yaml, yarn.lock or bun.lock) for these packages, including copies pulled in by other dependencies, and tell me which versions are installed.
2. If none of them are installed, or every installed version is outside the affected ranges, say so and change nothing.
3. If an installed version is affected, upgrade it to the fixed version for its release line or later. When the package only comes in through another dependency, upgrade that dependency, or add an override or resolution if it has no fixed release yet.
4. If there is no fixed version, read the advisory and apply its workaround, or tell me the options.
5. Reinstall, run the build and the tests, and fix anything the upgrade breaks.
6. Tell me what you changed and which versions are installed now.
  • highApr 24, 2025

    React Router allows pre-render data spoofing on React-Router framework mode

    • react-router >= 7.0.0-pre.0, <= 7.5.1 · fixed in 7.5.2
    GHSA-cpj6-fhp6-mr6jCVE-2025-43865
    prompt for your AI agent
    paste into your agent
    A security advisory covers a package this project may use.

Advisory: GHSA-cpj6-fhp6-mr6j (CVE-2025-43865), severity high
What it is: React Router allows pre-render data spoofing on React-Router framework mode
Affected packages:
- react-router: affected versions >= 7.0.0-pre.0, <= 7.5.1. Fixed in 7.5.2.
Details: https://github.com/advisories/GHSA-cpj6-fhp6-mr6j

Please:
1. Check package.json and the lockfile (package-lock.json, pnpm-lock.yaml, yarn.lock or bun.lock) for these packages, including copies pulled in by other dependencies, and tell me which versions are installed.
2. If none of them are installed, or every installed version is outside the affected ranges, say so and change nothing.
3. If an installed version is affected, upgrade it to the fixed version for its release line or later. When the package only comes in through another dependency, upgrade that dependency, or add an override or resolution if it has no fixed release yet.
4. If there is no fixed version, read the advisory and apply its workaround, or tell me the options.
5. Reinstall, run the build and the tests, and fix anything the upgrade breaks.
6. Tell me what you changed and which versions are installed now.
  • highApr 24, 2025

    React Router allows a DoS via cache poisoning by forcing SPA mode

    • react-router >= 7.2.0, <= 7.5.1 · fixed in 7.5.2
    GHSA-f46r-rw29-r322CVE-2025-43864
    prompt for your AI agent
    paste into your agent
    A security advisory covers a package this project may use.

Advisory: GHSA-f46r-rw29-r322 (CVE-2025-43864), severity high
What it is: React Router allows a DoS via cache poisoning by forcing SPA mode
Affected packages:
- react-router: affected versions >= 7.2.0, <= 7.5.1. Fixed in 7.5.2.
Details: https://github.com/advisories/GHSA-f46r-rw29-r322

Please:
1. Check package.json and the lockfile (package-lock.json, pnpm-lock.yaml, yarn.lock or bun.lock) for these packages, including copies pulled in by other dependencies, and tell me which versions are installed.
2. If none of them are installed, or every installed version is outside the affected ranges, say so and change nothing.
3. If an installed version is affected, upgrade it to the fixed version for its release line or later. When the package only comes in through another dependency, upgrade that dependency, or add an override or resolution if it has no fixed release yet.
4. If there is no fixed version, read the advisory and apply its workaround, or tell me the options.
5. Reinstall, run the build and the tests, and fix anything the upgrade breaks.
6. Tell me what you changed and which versions are installed now.

From the GitHub Advisory Database, refreshed hourly. Full history on GitHub.

Keeping React Router and Remix patched

  • npm audit (or pnpm audit) lists known vulnerable packages in your lockfile, including ones pulled in by other packages.
  • Turn on Dependabot for your GitHub repo and it opens the upgrade for you when an advisory lands.
  • A patched framework doesn't cover your own setup: headers, cookies and HTTPS. The free check looks at those.