react-router

React Router: RSC Mode CSRF Bypass Allows Action Execution Before 400 Response

7.18.2, 8.3.0security advisory

React Router: Arbitrary Constructor Injection via deserializeErrors() in React Router SSR Hydration

7.18.0security advisory

React Router: Open redirect via backslash in <Link> and useNavigate (CVE-2025-68470 bypass)

7.18.0security advisory

React Router: RSCErrorHandler Missing Protocol Validation (XSS)

7.18.0security advisory

React Router: Unauthenticated Denial of Service via Inefficient Route Matching

7.18.0security advisory

React Router: Potential CSRF via PUT/PATCH/DELETE document requests

7.15.1security advisory

React Router vulnerable to DoS via unbounded path expansion in __manifest endpoint

7.15.0security advisory

React Router's vendored turbo-stream v2 allows arbitrary constructor invocation via TYPE_ERROR deserialization leading to Unauth RCE

7.14.2security advisory

React Router's same-origin redirect with path starting // causes open redirect via protocol-relative URL reinterpretation

6.30.4, 7.14.1security advisory

React Router vulnerable to Denial of Service via reflected user input in single-fetch

7.14.0security advisory

React Router has stored XSS via unescaped Location header in prerendered redirect HTML

7.13.2security advisory

React Router vulnerable to XSS in unstable RSC redirect handling via javascript: redirect targets

7.13.2security advisory

React Router: Open redirect leading to XSS

7.13.0security advisory

React Router has CSRF issue in Action/Server Action Request Processing

7.12.0security advisory

React Router SSR XSS in ScrollRestoration

7.12.0security advisory

React Router vulnerable to XSS via Open Redirects

7.12.0security advisory

React Router has unexpected external redirect via untrusted paths

6.30.2, 7.9.6security advisory