Update dependency react-router to v7.18.2 [SECURITY] #9
Loading…
Add table
Add a link
Reference in a new issue
No description provided.
Delete branch "renovate/npm-react-router-vulnerability"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
This PR contains the following updates:
7.16.0→7.18.2React Router: Arbitrary Constructor Injection via deserializeErrors() in React Router SSR Hydration
CVE-2026-53666 / GHSA-337j-9hxr-rhxg
More information
Details
If application code allows attacker supplied input to overwrite certain aspects of errors caught by the SSR process, then it was possible for attacker to trigger unexpected constructor execution on the client which would trigger outbound network traffic. This is only possible with very specific (and unlikely) application layer code.
Severity
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:NReferences
This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).
React Router: Unauthenticated Denial of Service via Inefficient Route Matching
CVE-2026-55685 / GHSA-chx6-hx7r-mcp5
More information
Details
This is a follow up to https://github.com/remix-run/react-router/security/advisories/GHSA-8x6r-g9mw-2r78 that covers additional reported scenarios in which the manifest endpoint could be accessed via unauthenticated targeted requests that would put heavy load on the server and slow down response times.
Severity
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:NReferences
This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).
React Router: RSCErrorHandler Missing Protocol Validation (XSS)
CVE-2026-53667 / GHSA-h8fp-f39c-q6mh
More information
Details
This is a follow up to https://github.com/remix-run/react-router/security/advisories/GHSA-8646-j5j9-6r62. React Router was alerted of a code path in the (unstable) RSC error handling path in which redirects from untrusted sources could still result in an XSS vector via attacker-supplied redirect targets
Severity
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:L/A:NReferences
This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).
React Router: Open redirect via backslash in and useNavigate (CVE-2025-68470 bypass)
CVE-2026-53669 / GHSA-wrjc-x8rr-h8h6
More information
Details
This is a follow up to CVE-2025-68470. React Router was alerted to certain scenarios in which the fix there was incomplete so there still existed some scenarios where attacker supplied paths passed to navigation mechanisms could result in unexpected external navigations.
Severity
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:L/SI:L/SA:NReferences
This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).
React Router: RSC Mode CSRF Bypass Allows Action Execution Before 400 Response
GHSA-qwww-vcr4-c8h2
More information
Details
This is a follow up to CVE-2026-22030 to address related CSRF flows in unstable RSC code paths.
Severity
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:N/SC:N/SI:N/SA:NReferences
This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).
Release Notes
remix-run/react-router (react-router)
v7.18.2: v7.18.2Compare Source
See the changelog for release notes: https://github.com/remix-run/react-router/blob/v7/CHANGELOG.md#v7182
v7.18.1: v7.18.1Compare Source
See the changelog for release notes: https://github.com/remix-run/react-router/blob/v7/CHANGELOG.md#v7181
v7.18.0Compare Source
Patch Changes
ssr: falseandfuture.v8_trailingSlashAwareDataRequests: true. Avoids false positive "SPA Mode" detection when serving prerendered paths (#15173)ServerRouternonce for nonce-aware SSR components when they don't provide their own value so strict CSP pages can load them. (#15170)turbo-streamto serialize and deserialize Framework Mode hydration errors (#15175)v7.17.0Compare Source
Minor Changes
react-routerpackage (#15121)node_modules/react-router/docs, letting AI coding agents and the React Router agent skills read official docs locallyapi/),community/content, and tutorials (tutorials/)Configuration
📅 Schedule: (UTC)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR has been generated by Mend Renovate.
View command line instructions
Checkout
From your project repository, check out a new branch and test the changes.Merge
Merge the changes and update on Forgejo.Warning: The "Autodetect manual merge" setting is not enabled for this repository, you will have to mark this pull request as manually merged afterwards.