Vendor
Remix-run
21 known vulnerabilities in products by Remix-run, 0 of them actively exploited (CISA KEV).
Key figures
21
Vulnerabilities
0
Actively exploited (KEV)
0
Used by ransomware
1
Critical
Vulnerabilities
Actively exploited vulnerabilities (CISA KEV) first, then by priority. Click a column header to re-sort the table.
| Critical | CVE-2025-61686 | React Router has Path Traversal in File Session Storage | 9.1 | |
| High | CVE-2025-43864 | React Router allows a DoS via cache poisoning by forcing SPA mode | 7.5 | |
| High | CVE-2026-55685 | React Router: Unauthenticated Denial of Service via Inefficient Route Matching | 7.5 | |
| High | CVE-2025-31137 | Remix and React Router allow URL manipulation via Host / X-Forwarded-Host headers | 7.5 | |
| High | CVE-2026-22029 | React Router vulnerable to XSS via Open Redirects | 8.0 | |
| High | CVE-2025-43865 | React Router allows pre-render data spoofing on React-Router framework mode | 8.2 | |
| High | CVE-2026-21884 | React Router SSR XSS in ScrollRestoration | 8.2 | |
| High | CVE-2026-42211 | Remix-run React-router: Deserialization of Untrusted Data | 8.1 | |
| High | CVE-2025-59057 | React Router has XSS Vulnerability | 7.6 | |
| Medium | CVE-2026-53666 | React Router: Arbitrary Constructor Injection via deserializeErrors() in React Router SSR Hydration | 6.1 | |
| Medium | CVE-2026-53668 | React Router: Open redirect can lead to XSS | 6.9 | |
| Medium | CVE-2025-68470 | React Router has unexpected external redirect via untrusted paths | 6.5 | |
| High | CVE-2026-42342 | React Router vulnerable to DoS via unbounded path expansion in __manifest endpoint | 7.5 | |
| High | CVE-2026-34077 | React Router vulnerable to Denial of Service via reflected user input in single-fetch | 7.5 | |
| Medium | CVE-2026-53667 | Remix-run React-router: Cross-site Scripting | 6.1 | |
| High | CVE-2026-33245 | React Router vulnerable to XSS in unstable RSC redirect handling via javascript: redirect targets | 8.0 | |
| Medium | CVE-2026-53669 | React Router: Open redirect via backslash in <Link> and useNavigate (CVE-2025-68470 bypass) | 6.1 | |
| Medium | CVE-2026-40181 | Remix-run React-router: Open Redirect | 6.1 | |
| Medium | CVE-2026-22030 | React Router has CSRF issue in Action/Server Action Request Processing | 6.5 | |
| Medium | CVE-2026-33244 | React Router has stored XSS via unescaped Location header in prerendered redirect HTML | 5.4 | |
| Low | CVE-2026-53663 | React Router: `handleDocumentRequest` CSRF check covers `POST` only; PUT/PATCH/DELETE bypass | 3.1 |
Products
| React-router | 21 | 0 |