Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
7.5

React Router could run malicious code via redirects

CVE-2026-34077 · published 5 months ago
Summary

Versions 7.7.0 through 7.13.1 of React Router may allow harmful scripts to run if a redirect comes from an untrusted source while using the experimental server‑side features. This could let attackers manipulate what users see or steal information. Update to version 7.13.2 or later to stop the risk.

What to do
  • Update GitHub Actions react-router to version 7.14.0.
  • Update jacob-ebey turbo-stream to version 3.0.0.
  • Update rootio @rootio/react-router to version 7.12.0-root.io.3.
  • Update GitHub Actions react-router to version 7.12.0-aikido.3.
  • Update shopify react-router to version 7.14.0 or later.
  • Update turbo-stream turbo_stream to version 3.0.0 or later.
Affected software
Ecosystem VendorProductAffected versions
npm GitHub Actions react-router >= 7.0.0, < 7.14.0
Fix: upgrade to 7.14.0
npm jacob-ebey turbo-stream < 3.0.0
Fix: upgrade to 3.0.0
– shopify react-router >= 7.0.0, < 7.14.0
cpe:2.3:a:shopify:react-router:*:*:*:*:*:node.js:*:*
– turbo-stream turbo_stream < 3.0.0
cpe:2.3:a:turbo-stream:turbo_stream:*:*:*:*:*:node.js:*:*
Root:npm rootio @rootio/react-router < 7.12.0-root.io.3
Fix: upgrade to 7.12.0-root.io.3
Root:npm GitHub Actions react-router < 7.12.0-aikido.3
Fix: upgrade to 7.12.0-aikido.3
Original advisory text
React Router vulnerable to Denial of Service via reflected user input in single-fetch
React Router is a router for React. In versions 7.7.0 through 7.13.1, when using React Router's unstable React Server Components (RSC) APIs, there is a potential client-side Cross-Site Scripting (XSS) vulnerability in the RSC redirect handling if redirects come from untrusted sources. This does not impact applications that are not using the unstable RSC APIs in React Router. This is patched in version 7.13.2.
References
Fix within
Internet-facing 14 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically
  • Gives an attacker partial control
Severity
7.5 High
Exploitation
<1% chance of attack within 30 days
Type
CWE-770Allocation of Resources Without Limits
Timeline
Published2 Jun 2026
Updated3 Nov 2026
First seen2 Jun 2026
Sources
CVE-2026-34077 · NVD
GHSA-rxv8-25v2-qmq8 · GHSA
ROOT-APP-NPM-CVE-2026-34077 · OSV
CVE-2026-34077 · OSV
Track software like this
Free during beta