PT-2026-64213 · Npm · React Router

CVE-2026-53667 · Published 2026-07-23 · Updated 2026-07-23

OSV

CVSS v3.1

6.9

Medium

Base vector

AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:L/A:N

This is a follow up to https://github.com/remix-run/react-router/security/advisories/GHSA-8646-j5j9-6r62. React Router was alerted of a code path in the (unstable) RSC error handling path in which redirects from untrusted sources could still result in an XSS vector via attacker-supplied redirect targets

[!NOTE] This only affects your application if you are using the unstable RSC APIs

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-53667

GHSA-H8FP-F39C-Q6MH

Affected Products

React Router

References · 7

• https://osv.dev/vulnerability/GHSA-h8fp-f39c-q6mh · Vendor Advisory
• https://github.com/remix-run/react-router/releases/tag/react-router@7.18.0 · Note
• https://github.com/remix-run/react-router/commit/ce596e823f0d7b883a433af1d5a839a8b9fe0242 · Note
• https://github.com/remix-run/react-router/security/advisories/GHSA-h8fp-f39c-q6mh · Note
• https://github.com/remix-run/react-router/pull/15177 · Note
• https://github.com/remix-run/react-router · Note
• https://github.com/remix-run/react-router/blob/main/CHANGELOG.md#v7180 · Note