CVE-2026-53667

MediumCVSS 6.1/10Last modified Oct 24, 2026

Description

React Router is a router for React. In versions 7.11.0 through 7.17.0, the RSCErrorHandler is missing protocol validation, allowing for redirects from untrusted sources. This issue is a follow up to CVE-2026-53667, and only affects consuming applications if they are using the unstable RSC APIs. This issue has been fixed in version 7.18.0.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
remix-run	react-router	>= 7.11.0, < 7.18.0

References

https://github.com/remix-run/react-router/blob/main/CHANGELOG.md#v7180Release Notes
https://github.com/remix-run/react-router/commit/ce596e823f0d7b883a433af1d5a839a8b9fe0242Patch
https://github.com/remix-run/react-router/pull/15177Issue Tracking, Patch
https://github.com/remix-run/react-router/releases/tag/react-router@7.18.0Release Notes
https://github.com/remix-run/react-router/security/advisories/GHSA-h8fp-f39c-q6mhThird Party Advisory

Timeline

Published: Jul 27, 2026
Last modified: Oct 24, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-536686.9React Router is a router for React. In versions 6.30.2 through 6.30.4 and 7.9.6 through 7.12.0, applications that allow open redirects are v CVE-2026-536696.1React Router is a router for React. Versions 6.0.0 through 7.17.0 are vulnerable to Open Redirtect through use of backslashes in <Link> and CVE-2026-53678.6A flaw was found in OVN (Open Virtual Network). A remote attacker, by sending crafted DHCPv6 (Dynamic Host Configuration Protocol for IPv6) CVE-2026-536709.3PREVAIL is a Polynomial-Runtime EBPF Verifier using an Abstract Interpretation Layer. Prior to version 0.2.4, in the Prevail eBPF verifier, CVE-2026-536719.3PREVAIL is a Polynomial-Runtime EBPF Verifier using an Abstract Interpretation Layer. Prior to version 0.2.4, the abstract transformer in pr CVE-2026-536738.1BuddyPress 14.4.0 contains an insecure direct object reference vulnerability in the messages REST API that allows authenticated attackers to CVE-2026-536747.1BuddyPress 14.4.0 contains a regular expression injection vulnerability in the activity mention resolver that, when username compatibility m CVE-2026-536754.3BuddyPress 14.4.0 contains an insecure direct object reference vulnerability in the friends REST API that allows any authenticated attacker CVE-2026-536768.6ThingsBoard contains a prototype pollution vulnerability which may lead to arbitrary code execution within a sandboxed context by a user who CVE-2026-53689.8A vulnerability was determined in projectworlds Car Rental Project 1.0. The affected element is an unknown function of the file /login.php o CVE-2026-536825.3An unauthenticated client can query the Security Domain hosts inventory via GET /ca/rest/securityDomain/hosts and receive a structured respo CVE-2026-536834.3reset_password.html parses query string parameters and uses the 'url' parameter as a redirection target (window.location = url) after passwo