PT-2026-45835 · Remix+1 · @Remix-Run/Server-Runtime+1

Adrgs · CVE-2026-42342 · Published 2026-06-02 · Updated 2026-07-28

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions react-router versions 7.0.0 through 7.14.x @remix-run/server-runtime versions 2.10.0 through 2.17.4

Description Certain crafted requests can cause disproportionate server resource consumption through unbounded path expansion at the manifest endpoint. This issue leads to response time degradation or service unavailability for end users. The problem specifically affects Remix applications and React Router applications operating in Framework Mode. It does not impact applications using Declarative Mode (<BrowserRouter>) or Data Mode (createBrowserRouter/<RouterProvider>).

Recommendations Update react-router to version 7.15.0. Update @remix-run/server-runtime to version 2.17.5.

Exploit

Fix

DoS

Resource Exhaustion

Weakness Enumeration

CWE-400

Related Identifiers

CVE-2026-42342

GHSA-8X6R-G9MW-2R78

Affected Products

@Remix-Run/Server-Runtime

React Router

References · 12

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/42xxx/CVE-2026-42342.json · Exploit
• https://github.com/remix-run/react-router/security/advisories/GHSA-8x6r-g9mw-2r78 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-8x6r-g9mw-2r78 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-42342 · Security Note
• https://osv.dev/vulnerability/CVE-2026-42342 · Vendor Advisory
• https://github.com/remix-run/react-router · Note
• https://reddit.com/r/VulnMatter/comments/1twnlt9/resumen_diario_de_vulnerabilidades_04062026 · Reddit Post
• https://t.me/cveNotify/225629 · Telegram Post
• https://reddit.com/r/VulnMatter/comments/1twnnbr/resumen_diario_de_vulnerabilidades_04062026 · Reddit Post
• https://twitter.com/dailycve/status/2062376893555335283 · Twitter Post
• https://t.me/cveNotify/225825 · Telegram Post
• https://t.me/CVEtracker/61401 · Telegram Post