react-router has 5 CVEs on record. The busiest recent month was July 2026 with 4. The median CVSS is 6.5 (medium). None have a confirmed exploitation report.
CVEs per month
Last 12 months, by publish date
1125/111225/120126/010226/020326/030426/040526/050626/060726/070826/080926/091026/10
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 6.5
- Publish → KEV
- —
- Last 90 days
- 0 prev 5
5
Total CVEs
0
Critical
0
CISA KEV
0
Exploited
Worst active — by depth score
GHSA-qwww-vcr4-c8h2HighReact Router: RSC Mode CSRF Bypass Allows Action Execution Before 400 Response41CVE-2026-53668Medium· 6.9React Router: Open redirect leading to XSS38CVE-2026-53667Medium· 6.9React Router: RSCErrorHandler Missing Protocol Validation (XSS)38CVE-2026-53666Medium· 6.1React Router: Arbitrary Constructor Injection via deserializeErrors() in React Router SSR Hydration34CVE-2026-53663Low· 3.1React Router: Potential CSRF via PUT/PATCH/DELETE document requests17
react-router vulnerabilities
CVEs affecting react-router, newest first. Open any entry for full detail, references, and exploit status.
5 CVEsRSS
GHSA-qwww-vcr4-c8h2HighReact Router: RSC Mode CSRF Bypass Allows Action Execution Before 400 Response
React Router: RSC Mode CSRF Bypass Allows Action Execution Before 400 Response
▾ Twilightreact-router · react-routervia GHSA
CVE-2026-53666Medium· 6.1React Router: Arbitrary Constructor Injection via deserializeErrors() in React Router SSR Hydration
React Router: Arbitrary Constructor Injection via deserializeErrors() in React Router SSR Hydration
▾ Sunlitreact-router · react-routerEPSS 0.42%via GHSA
CVE-2026-53667Medium· 6.9React Router: RSCErrorHandler Missing Protocol Validation (XSS)
React Router: RSCErrorHandler Missing Protocol Validation (XSS)
▾ Sunlitreact-router · react-routerEPSS 0.36%via GHSA
CVE-2026-53668Medium· 6.9React Router: Open redirect leading to XSS
React Router: Open redirect leading to XSS
▾ Sunlitreact-router · react-routerEPSS 0.34%via GHSA
CVE-2026-53663Low· 3.1React Router: Potential CSRF via PUT/PATCH/DELETE document requests
React Router: Potential CSRF via PUT/PATCH/DELETE document requests
▾ Sunlitreact-router · react-routerEPSS 0.15%via GHSA