PT-2026-45835 · Remix Run · @Remix-Run/Server-Runtime+1

Published 2026-06-02 · Updated 2026-06-02 · CVE-2026-42342

NVD

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

React Router is a router for React. In versions 7.0.0 through 7.14.x of react-router and versions 2.10.0 through 2.17.4 of @remix-run/server-runtime, certain crafted requests can consume disproportionate server resources via unbounded path expansion in the manifest endpoint, resulting in response time degradation and/or service unavailability for end users. This affects React Router Framework Mode applications as well as Remix applications. This does not impact applications using Declarative Mode (<BrowserRouter>) or Data Mode (createBrowserRouter/<RouterProvider>). This is patched in react-router version 7.15.0 and @remix-run/server-runtime version 2.17.5.

Fix

Resource Exhaustion

Weakness Enumeration

CWE-400

Related Identifiers

CVE-2026-42342

Affected Products

@Remix-Run/Server-Runtime

React Router

References · 2

• https://nvd.nist.gov/vuln/detail/CVE-2026-42342 · Security Note
• https://github.com/remix-run/react-router/security/advisories/GHSA-8x6r-g9mw-2r78 · Note