PT-2026-46089 · Npm · @Remix-Run/Server-Runtime+1

Published 2026-06-03 · Updated 2026-06-03

OSV

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

There exists a potential DOS attack vector in React Router Framework Mode applications (as well as Remix v2.10.0 - 2.17.4). Certain requests can be crafted to consume disproportionate resources on the server, resulting in response time degredation and/or service unavailability for end users.

[!NOTE] This does not impact your React Router application if you are using Declarative Mode (<BrowserRouter>) or Data Mode (createBrowserRouter/<RouterProvider>).

Fix

Resource Exhaustion

Weakness Enumeration

CWE-400

Related Identifiers

GHSA-8X6R-G9MW-2R78

Affected Products

@Remix-Run/Server-Runtime

React Router

References · 4

• https://osv.dev/vulnerability/GHSA-8x6r-g9mw-2r78 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-42342 · Security Note
• https://github.com/remix-run/react-router · Note
• https://github.com/remix-run/react-router/security/advisories/GHSA-8x6r-g9mw-2r78 · Note