Product by Shopify

    Shopify React-router

    17 known vulnerabilities in Shopify React-router (Shopify), 0 of them actively exploited (CISA KEV).

    Key figures

    17

    Vulnerabilities

    0

    Actively exploited (KEV)

    0

    Used by ransomware

    1

    Critical

    Vulnerabilities

    Actively exploited vulnerabilities (CISA KEV) first, then by priority. Click a column header to re-sort the table.

    Vulnerabilities in Shopify React-router (Shopify)
    CriticalCVE-2025-61686

    React Router has Path Traversal in File Session Storage

    also in 2 other products

    		9.1
    HighCVE-2026-55685

    React Router: Unauthenticated Denial of Service via Inefficient Route Matching

    also in 1 other product

    		7.5
    HighCVE-2026-22029

    React Router vulnerable to XSS via Open Redirects

    also in 3 other products

    		8.0
    HighCVE-2026-21884

    React Router SSR XSS in ScrollRestoration

    also in 2 other products

    		8.2
    HighCVE-2026-42211

    Remix-run React-router: Deserialization of Untrusted Data

    also in 2 other products

    		8.1
    HighCVE-2025-59057

    React Router has XSS Vulnerability

    also in 2 other products

    		7.6
    MediumCVE-2026-53666

    React Router: Arbitrary Constructor Injection via deserializeErrors() in React Router SSR Hydration

    also in 1 other product

    		6.1
    MediumCVE-2026-53668

    React Router: Open redirect can lead to XSS

    also in 1 other product

    		6.9
    MediumCVE-2025-68470

    React Router has unexpected external redirect via untrusted paths

    also in 2 other products

    		6.5
    HighCVE-2026-42342

    React Router vulnerable to DoS via unbounded path expansion in __manifest endpoint

    also in 2 other products

    		7.5
    HighCVE-2026-34077

    React Router vulnerable to Denial of Service via reflected user input in single-fetch

    also in 2 other products

    		7.5
    MediumCVE-2026-53667

    Remix-run React-router: Cross-site Scripting

    also in 1 other product

    		6.1
    HighCVE-2026-33245

    React Router vulnerable to XSS in unstable RSC redirect handling via javascript: redirect targets

    also in 1 other product

    		8.0
    MediumCVE-2026-53669

    React Router: Open redirect via backslash in <Link> and useNavigate (CVE-2025-68470 bypass)

    also in 1 other product

    		6.1
    MediumCVE-2026-40181

    Remix-run React-router: Open Redirect

    also in 2 other products

    		6.1
    MediumCVE-2026-22030

    React Router has CSRF issue in Action/Server Action Request Processing

    also in 2 other products

    		6.5
    MediumCVE-2026-33244

    React Router has stored XSS via unescaped Location header in prerendered redirect HTML

    also in 1 other product

    		5.4

    All products by Shopify