Unknown · React Router · CVE-2026-40181
**Name of the Vulnerable Software and Affected Versions**
React Router versions 6.7.0 through 6.30.3
React Router versions 7.0.0 through 7.14.0
**Description**
Certain URLs passed to the `redirect()` function can trigger an open redirect to an external domain. This occurs because path values starting with // are reinterpreted as protocol-relative URLs, which are URLs that inherit the protocol (HTTP or HTTPS) of the current page. The impact depends on the validation performed by the application before the redirect is returned. This issue does not affect applications using Declarative Mode (`<BrowserRouter>`).
**Recommendations**
Update to version 6.30.4 for versions 6.7.0 through 6.30.3.
Update to version 7.14.1 for versions 7.0.0 through 7.14.0.