Update dependency react-router to v7.18.2 [SECURITY] #9

Open
renovate wants to merge 1 commit from renovate/npm-react-router-vulnerability into main
Member

This PR contains the following updates:

Package Change Age Confidence
react-router (source) 7.16.07.18.2 age confidence

React Router: Arbitrary Constructor Injection via deserializeErrors() in React Router SSR Hydration

CVE-2026-53666 / GHSA-337j-9hxr-rhxg

More information

Details

If application code allows attacker supplied input to overwrite certain aspects of errors caught by the SSR process, then it was possible for attacker to trigger unexpected constructor execution on the client which would trigger outbound network traffic. This is only possible with very specific (and unlikely) application layer code.

Note

This does not impact your application if you are using Declarative Mode. This only impacts Framework Mode and Data Mode applications doing manual SSR/hydration

Severity

  • CVSS Score: 6.1 / 10 (Medium)
  • Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

References

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).


React Router: Unauthenticated Denial of Service via Inefficient Route Matching

CVE-2026-55685 / GHSA-chx6-hx7r-mcp5

More information

Details

This is a follow up to https://github.com/remix-run/react-router/security/advisories/GHSA-8x6r-g9mw-2r78 that covers additional reported scenarios in which the manifest endpoint could be accessed via unauthenticated targeted requests that would put heavy load on the server and slow down response times.

Note

This only impacts Framework Mode applications. This does not impact your application if you are using Declarative or Data Mode.

Severity

  • CVSS Score: 8.7 / 10 (High)
  • Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

References

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).


React Router: RSCErrorHandler Missing Protocol Validation (XSS)

CVE-2026-53667 / GHSA-h8fp-f39c-q6mh

More information

Details

This is a follow up to https://github.com/remix-run/react-router/security/advisories/GHSA-8646-j5j9-6r62. React Router was alerted of a code path in the (unstable) RSC error handling path in which redirects from untrusted sources could still result in an XSS vector via attacker-supplied redirect targets

Note

This only affects your application if you are using the unstable RSC APIs

Severity

  • CVSS Score: 6.9 / 10 (Medium)
  • Vector String: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:L/A:N

References

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).


CVE-2026-53669 / GHSA-wrjc-x8rr-h8h6

More information

Details

This is a follow up to CVE-2025-68470. React Router was alerted to certain scenarios in which the fix there was incomplete so there still existed some scenarios where attacker supplied paths passed to navigation mechanisms could result in unexpected external navigations.

Severity

  • CVSS Score: 5.1 / 10 (Medium)
  • Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:L/SI:L/SA:N

References

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).


React Router: RSC Mode CSRF Bypass Allows Action Execution Before 400 Response

GHSA-qwww-vcr4-c8h2

More information

Details

This is a follow up to CVE-2026-22030 to address related CSRF flows in unstable RSC code paths.

Note

This only affects your application if you are using the unstable RSC APIs

Severity

  • CVSS Score: 7.1 / 10 (High)
  • Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

References

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).


Release Notes

remix-run/react-router (react-router)

v7.18.2: v7.18.2

Compare Source

See the changelog for release notes: https://github.com/remix-run/react-router/blob/v7/CHANGELOG.md#v7182

v7.18.1: v7.18.1

Compare Source

See the changelog for release notes: https://github.com/remix-run/react-router/blob/v7/CHANGELOG.md#v7181

v7.18.0

Compare Source

Patch Changes
  • Fix server handler prerender responses when using ssr: false and future.v8_trailingSlashAwareDataRequests: true. Avoids false positive "SPA Mode" detection when serving prerendered paths (#​15173)
  • Use the ServerRouter nonce for nonce-aware SSR components when they don't provide their own value so strict CSP pages can load them. (#​15170)
  • Use turbo-stream to serialize and deserialize Framework Mode hydration errors (#​15175)
  • Precompute route branch matchers to avoid recompiling route path regexes during matching (#​15186)
  • Use the constructed request URL host when validating action request origins. (#​15185)
  • Remove the un-documented custom error serialization logic from Data Mode SSR built-in hydration flows (#​15175)
  • Validate protocols in RSC render redirects (#​15177)
  • Consolidate url normalization logic and better handle mixed slashes (#​15176)

v7.17.0

Compare Source

Minor Changes
  • Ship a subset of the official documentation inside the react-router package (#​15121)
    • Markdown docs are now available in node_modules/react-router/docs, letting AI coding agents and the React Router agent skills read official docs locally
    • Excludes auto-generated API docs (api/), community/ content, and tutorials (tutorials/)

Configuration

📅 Schedule: (UTC)

  • Branch creation
    • ""
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.


  • If you want to rebase/retry this PR, check this box

This PR has been generated by Mend Renovate.

This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [react-router](https://github.com/remix-run/react-router) ([source](https://github.com/remix-run/react-router/tree/HEAD/packages/react-router)) | [`7.16.0` → `7.18.2`](https://renovatebot.com/diffs/npm/react-router/7.16.0/7.18.2) | ![age](https://developer.mend.io/api/mc/badges/age/npm/react-router/7.18.2?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/react-router/7.16.0/7.18.2?slim=true) | --- ### React Router: Arbitrary Constructor Injection via deserializeErrors() in React Router SSR Hydration [CVE-2026-53666](https://nvd.nist.gov/vuln/detail/CVE-2026-53666) / [GHSA-337j-9hxr-rhxg](https://github.com/advisories/GHSA-337j-9hxr-rhxg) <details> <summary>More information</summary> #### Details If application code allows attacker supplied input to overwrite certain aspects of errors caught by the SSR process, then it was possible for attacker to trigger unexpected constructor execution on the client which would trigger outbound network traffic. This is only possible with very specific (and unlikely) application layer code. > [!NOTE] > This does not impact your application if you are using Declarative Mode. This only impacts Framework Mode and Data Mode applications doing manual SSR/hydration #### Severity - CVSS Score: 6.1 / 10 (Medium) - Vector String: `CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N` #### References - [https://github.com/remix-run/react-router/security/advisories/GHSA-337j-9hxr-rhxg](https://github.com/remix-run/react-router/security/advisories/GHSA-337j-9hxr-rhxg) - [https://github.com/remix-run/react-router/pull/15175](https://github.com/remix-run/react-router/pull/15175) - [https://github.com/remix-run/react-router/commit/9d22943fd46c8ae4b08236425fa3549e10e9ad1a](https://github.com/remix-run/react-router/commit/9d22943fd46c8ae4b08236425fa3549e10e9ad1a) - [https://github.com/remix-run/react-router](https://github.com/remix-run/react-router) - [https://github.com/remix-run/react-router/blob/main/CHANGELOG.md#v7180](https://github.com/remix-run/react-router/blob/main/CHANGELOG.md#v7180) - [https://github.com/remix-run/react-router/releases/tag/react-router@7.18.0](https://github.com/remix-run/react-router/releases/tag/react-router@7.18.0) This data is provided by [OSV](https://osv.dev/vulnerability/GHSA-337j-9hxr-rhxg) and the [GitHub Advisory Database](https://github.com/github/advisory-database) ([CC-BY 4.0](https://github.com/github/advisory-database/blob/main/LICENSE.md)). </details> --- ### React Router: Unauthenticated Denial of Service via Inefficient Route Matching [CVE-2026-55685](https://nvd.nist.gov/vuln/detail/CVE-2026-55685) / [GHSA-chx6-hx7r-mcp5](https://github.com/advisories/GHSA-chx6-hx7r-mcp5) <details> <summary>More information</summary> #### Details This is a follow up to https://github.com/remix-run/react-router/security/advisories/GHSA-8x6r-g9mw-2r78 that covers additional reported scenarios in which the manifest endpoint could be accessed via unauthenticated targeted requests that would put heavy load on the server and slow down response times. > [!NOTE] > This only impacts Framework Mode applications. This does not impact your application if you are using Declarative or Data Mode. #### Severity - CVSS Score: 8.7 / 10 (High) - Vector String: `CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N` #### References - [https://github.com/remix-run/react-router/security/advisories/GHSA-chx6-hx7r-mcp5](https://github.com/remix-run/react-router/security/advisories/GHSA-chx6-hx7r-mcp5) - [https://github.com/remix-run/react-router/pull/15186](https://github.com/remix-run/react-router/pull/15186) - [https://github.com/remix-run/react-router/commit/09e6020d1950e54f361f7ad00938ecd4dde60929](https://github.com/remix-run/react-router/commit/09e6020d1950e54f361f7ad00938ecd4dde60929) - [https://github.com/remix-run/react-router](https://github.com/remix-run/react-router) - [https://github.com/remix-run/react-router/blob/main/CHANGELOG.md#v7180](https://github.com/remix-run/react-router/blob/main/CHANGELOG.md#v7180) - [https://github.com/remix-run/react-router/releases/tag/react-router@7.18.0](https://github.com/remix-run/react-router/releases/tag/react-router@7.18.0) This data is provided by [OSV](https://osv.dev/vulnerability/GHSA-chx6-hx7r-mcp5) and the [GitHub Advisory Database](https://github.com/github/advisory-database) ([CC-BY 4.0](https://github.com/github/advisory-database/blob/main/LICENSE.md)). </details> --- ### React Router: RSCErrorHandler Missing Protocol Validation (XSS) [CVE-2026-53667](https://nvd.nist.gov/vuln/detail/CVE-2026-53667) / [GHSA-h8fp-f39c-q6mh](https://github.com/advisories/GHSA-h8fp-f39c-q6mh) <details> <summary>More information</summary> #### Details This is a follow up to https://github.com/remix-run/react-router/security/advisories/GHSA-8646-j5j9-6r62. React Router was alerted of a code path in the (unstable) RSC error handling path in which redirects from untrusted sources could still result in an XSS vector via attacker-supplied redirect targets > [!NOTE] > This only affects your application if you are using the unstable RSC APIs #### Severity - CVSS Score: 6.9 / 10 (Medium) - Vector String: `CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:L/A:N` #### References - [https://github.com/remix-run/react-router/security/advisories/GHSA-h8fp-f39c-q6mh](https://github.com/remix-run/react-router/security/advisories/GHSA-h8fp-f39c-q6mh) - [https://github.com/remix-run/react-router/pull/15177](https://github.com/remix-run/react-router/pull/15177) - [https://github.com/remix-run/react-router/commit/ce596e823f0d7b883a433af1d5a839a8b9fe0242](https://github.com/remix-run/react-router/commit/ce596e823f0d7b883a433af1d5a839a8b9fe0242) - [https://github.com/remix-run/react-router](https://github.com/remix-run/react-router) - [https://github.com/remix-run/react-router/blob/main/CHANGELOG.md#v7180](https://github.com/remix-run/react-router/blob/main/CHANGELOG.md#v7180) - [https://github.com/remix-run/react-router/releases/tag/react-router@7.18.0](https://github.com/remix-run/react-router/releases/tag/react-router@7.18.0) This data is provided by [OSV](https://osv.dev/vulnerability/GHSA-h8fp-f39c-q6mh) and the [GitHub Advisory Database](https://github.com/github/advisory-database) ([CC-BY 4.0](https://github.com/github/advisory-database/blob/main/LICENSE.md)). </details> --- ### React Router: Open redirect via backslash in <Link> and useNavigate (CVE-2025-68470 bypass) [CVE-2026-53669](https://nvd.nist.gov/vuln/detail/CVE-2026-53669) / [GHSA-wrjc-x8rr-h8h6](https://github.com/advisories/GHSA-wrjc-x8rr-h8h6) <details> <summary>More information</summary> #### Details This is a follow up to [CVE-2025-68470](https://github.com/remix-run/react-router/security/advisories/GHSA-9jcx-v3wj-wh4m). React Router was alerted to certain scenarios in which the fix there was incomplete so there still existed some scenarios where attacker supplied paths passed to navigation mechanisms could result in unexpected external navigations. #### Severity - CVSS Score: 5.1 / 10 (Medium) - Vector String: `CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:L/SI:L/SA:N` #### References - [https://github.com/remix-run/react-router/security/advisories/GHSA-wrjc-x8rr-h8h6](https://github.com/remix-run/react-router/security/advisories/GHSA-wrjc-x8rr-h8h6) - [https://github.com/remix-run/react-router/pull/15176](https://github.com/remix-run/react-router/pull/15176) - [https://github.com/remix-run/react-router](https://github.com/remix-run/react-router) - [https://github.com/remix-run/react-router/blob/main/CHANGELOG.md#v7180](https://github.com/remix-run/react-router/blob/main/CHANGELOG.md#v7180) - [https://github.com/remix-run/react-router/releases/tag/react-router@7.18.0](https://github.com/remix-run/react-router/releases/tag/react-router@7.18.0) - [http://github.com/remix-run/react-router/pull/15176](http://github.com/remix-run/react-router/pull/15176) This data is provided by [OSV](https://osv.dev/vulnerability/GHSA-wrjc-x8rr-h8h6) and the [GitHub Advisory Database](https://github.com/github/advisory-database) ([CC-BY 4.0](https://github.com/github/advisory-database/blob/main/LICENSE.md)). </details> --- ### React Router: RSC Mode CSRF Bypass Allows Action Execution Before 400 Response [GHSA-qwww-vcr4-c8h2](https://github.com/advisories/GHSA-qwww-vcr4-c8h2) <details> <summary>More information</summary> #### Details This is a follow up to CVE-2026-22030 to address related CSRF flows in unstable RSC code paths. > [!NOTE] > This only affects your application if you are using the unstable RSC APIs #### Severity - CVSS Score: 7.1 / 10 (High) - Vector String: `CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N` #### References - [https://github.com/remix-run/react-router/security/advisories/GHSA-qwww-vcr4-c8h2](https://github.com/remix-run/react-router/security/advisories/GHSA-qwww-vcr4-c8h2) - [https://github.com/remix-run/react-router/pull/15353](https://github.com/remix-run/react-router/pull/15353) - [https://github.com/remix-run/react-router/commit/7a71c728ad116bd78699a258b2014ce9585729f5](https://github.com/remix-run/react-router/commit/7a71c728ad116bd78699a258b2014ce9585729f5) - [https://github.com/remix-run/react-router/commit/8ebd5df9932854547963e3255c8454e62430e05d](https://github.com/remix-run/react-router/commit/8ebd5df9932854547963e3255c8454e62430e05d) - [https://github.com/remix-run/react-router](https://github.com/remix-run/react-router) - [https://github.com/remix-run/react-router/blob/main/CHANGELOG.md#v830](https://github.com/remix-run/react-router/blob/main/CHANGELOG.md#v830) - [https://github.com/remix-run/react-router/blob/v7/CHANGELOG.md#v7182](https://github.com/remix-run/react-router/blob/v7/CHANGELOG.md#v7182) - [https://github.com/remix-run/react-router/releases/tag/react-router%407.18.2](https://github.com/remix-run/react-router/releases/tag/react-router%407.18.2) - [https://github.com/remix-run/react-router/releases/tag/react-router@8.3.0](https://github.com/remix-run/react-router/releases/tag/react-router@8.3.0) - [http://github.com/remix-run/react-router/pull/15311](http://github.com/remix-run/react-router/pull/15311) This data is provided by [OSV](https://osv.dev/vulnerability/GHSA-qwww-vcr4-c8h2) and the [GitHub Advisory Database](https://github.com/github/advisory-database) ([CC-BY 4.0](https://github.com/github/advisory-database/blob/main/LICENSE.md)). </details> --- ### Release Notes <details> <summary>remix-run/react-router (react-router)</summary> ### [`v7.18.2`](https://github.com/remix-run/react-router/releases/tag/react-router%407.18.2): v7.18.2 [Compare Source](https://github.com/remix-run/react-router/compare/react-router@7.18.1...react-router@7.18.2) See the changelog for release notes: <https://github.com/remix-run/react-router/blob/v7/CHANGELOG.md#v7182> ### [`v7.18.1`](https://github.com/remix-run/react-router/releases/tag/react-router%407.18.1): v7.18.1 [Compare Source](https://github.com/remix-run/react-router/compare/react-router@7.18.0...react-router@7.18.1) See the changelog for release notes: <https://github.com/remix-run/react-router/blob/v7/CHANGELOG.md#v7181> ### [`v7.18.0`](https://github.com/remix-run/react-router/blob/HEAD/packages/react-router/CHANGELOG.md#v7180) [Compare Source](https://github.com/remix-run/react-router/compare/react-router@7.17.0...react-router@7.18.0) ##### Patch Changes - Fix server handler prerender responses when using `ssr: false` and `future.v8_trailingSlashAwareDataRequests: true`. Avoids false positive "SPA Mode" detection when serving prerendered paths ([#&#8203;15173](https://github.com/remix-run/react-router/pull/15173)) - Use the `ServerRouter` nonce for nonce-aware SSR components when they don't provide their own value so strict CSP pages can load them. ([#&#8203;15170](https://github.com/remix-run/react-router/pull/15170)) - Use `turbo-stream` to serialize and deserialize Framework Mode hydration errors ([#&#8203;15175](https://github.com/remix-run/react-router/pull/15175)) - Precompute route branch matchers to avoid recompiling route path regexes during matching ([#&#8203;15186](https://github.com/remix-run/react-router/pull/15186)) - Use the constructed request URL host when validating action request origins. ([#&#8203;15185](https://github.com/remix-run/react-router/pull/15185)) - Remove the un-documented custom error serialization logic from Data Mode SSR built-in hydration flows ([#&#8203;15175](https://github.com/remix-run/react-router/pull/15175)) - Validate protocols in RSC render redirects ([#&#8203;15177](https://github.com/remix-run/react-router/pull/15177)) - Consolidate url normalization logic and better handle mixed slashes ([#&#8203;15176](https://github.com/remix-run/react-router/pull/15176)) ### [`v7.17.0`](https://github.com/remix-run/react-router/blob/HEAD/packages/react-router/CHANGELOG.md#v7170) [Compare Source](https://github.com/remix-run/react-router/compare/react-router@7.16.0...react-router@7.17.0) ##### Minor Changes - Ship a subset of the official documentation inside the `react-router` package ([#&#8203;15121](https://github.com/remix-run/react-router/pull/15121)) - Markdown docs are now available in `node_modules/react-router/docs`, letting AI coding agents and the React Router agent skills read official docs locally - Excludes auto-generated API docs (`api/`), `community/` content, and tutorials (`tutorials/`) </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - "" - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate](https://github.com/renovatebot/renovate). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4xODYuNSIsInVwZGF0ZWRJblZlciI6IjQzLjE4Ni41IiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6W119-->
This pull request can be merged automatically.
You are not authorized to merge this pull request.
View command line instructions

Checkout

From your project repository, check out a new branch and test the changes.
git fetch -u origin renovate/npm-react-router-vulnerability:renovate/npm-react-router-vulnerability
git switch renovate/npm-react-router-vulnerability

Merge

Merge the changes and update on Forgejo.

Warning: The "Autodetect manual merge" setting is not enabled for this repository, you will have to mark this pull request as manually merged afterwards.

git switch main
git merge --no-ff renovate/npm-react-router-vulnerability
git switch renovate/npm-react-router-vulnerability
git rebase main
git switch main
git merge --ff-only renovate/npm-react-router-vulnerability
git switch renovate/npm-react-router-vulnerability
git rebase main
git switch main
git merge --no-ff renovate/npm-react-router-vulnerability
git switch main
git merge --squash renovate/npm-react-router-vulnerability
git switch main
git merge --ff-only renovate/npm-react-router-vulnerability
git switch main
git merge renovate/npm-react-router-vulnerability
git push origin main
Sign in to join this conversation.
No reviewers
No milestone
No project
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference
sr2/cloud-portal!9
No description provided.