PT-2026-46085 · Npm · React Router

Published 2026-06-03 · Updated 2026-06-03

OSV

CVSS v3.1

8.1

High

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

When using React Router v7 in Framework Mode, there exists a combination of steps that could potentially allow unauthorized RCE through external requests. This first requires the application code to have an existing prototype pollution vulnerability. This can be leveraged into a 2-step attack in which the second step can trigger unauthorized RCE on the remote server.

[!NOTE] This does not impact your React Router application if you are using Declarative Mode (<BrowserRouter>) or Data Mode (createBrowserRouter/<RouterProvider>).

Fix

Deserialization of Untrusted Data

Weakness Enumeration

CWE-502

Related Identifiers

GHSA-49RJ-9FVP-4H2H

Affected Products

React Router

References · 4

• https://osv.dev/vulnerability/GHSA-49rj-9fvp-4h2h · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-42211 · Security Note
• https://github.com/remix-run/react-router · Note
• https://github.com/remix-run/react-router/security/advisories/GHSA-49rj-9fvp-4h2h · Note