# What changed in react-router

> 17 changes in react-router 7 to 8 from its official release notes, upgrade guides and advisories: 17 security. Each one cited. Sources checked 2026-10-17. HTML: https://unstale.sh/npm/react-router/

To see which of these apply to a repository, run `npx @unstale/cli init` in it.

## react-router 8

### Security

- React Router: RSC Mode CSRF Bypass Allows Action Execution Before 400 Response (7.18.2, 8.3.0) — [security advisory](https://github.com/advisories/GHSA-QWWW-VCR4-C8H2)

## react-router 7

### Security

- React Router: Arbitrary Constructor Injection via deserializeErrors() in React Router SSR Hydration (7.18.0) — [security advisory](https://github.com/advisories/GHSA-337J-9HXR-RHXG)
- React Router: Open redirect via backslash in <Link> and useNavigate (CVE-2025-68470 bypass) (7.18.0) — [security advisory](https://github.com/advisories/GHSA-WRJC-X8RR-H8H6)
- React Router: RSCErrorHandler Missing Protocol Validation (XSS) (7.18.0) — [security advisory](https://github.com/advisories/GHSA-H8FP-F39C-Q6MH)
- React Router: Unauthenticated Denial of Service via Inefficient Route Matching (7.18.0) — [security advisory](https://github.com/advisories/GHSA-CHX6-HX7R-MCP5)
- React Router: Potential CSRF via PUT/PATCH/DELETE document requests (7.15.1) — [security advisory](https://github.com/advisories/GHSA-84G9-W2XQ-VCV6)
- React Router vulnerable to DoS via unbounded path expansion in __manifest endpoint (7.15.0) — [security advisory](https://github.com/advisories/GHSA-8X6R-G9MW-2R78)
- React Router's vendored turbo-stream v2 allows arbitrary constructor invocation via TYPE_ERROR deserialization leading to Unauth RCE (7.14.2) — [security advisory](https://github.com/advisories/GHSA-49RJ-9FVP-4H2H)
- React Router's same-origin redirect with path starting // causes open redirect via protocol-relative URL reinterpretation (6.30.4, 7.14.1) — [security advisory](https://github.com/advisories/GHSA-2J2X-HQR9-3H42)
- React Router vulnerable to Denial of Service via reflected user input in single-fetch (7.14.0) — [security advisory](https://github.com/advisories/GHSA-RXV8-25V2-QMQ8)
- React Router has stored XSS via unescaped Location header in prerendered redirect HTML (7.13.2) — [security advisory](https://github.com/advisories/GHSA-F22V-GFQF-P8F3)
- React Router vulnerable to XSS in unstable RSC redirect handling via javascript: redirect targets (7.13.2) — [security advisory](https://github.com/advisories/GHSA-8646-J5J9-6R62)
- React Router: Open redirect leading to XSS (7.13.0) — [security advisory](https://github.com/advisories/GHSA-JJMJ-JMHJ-QWJ2)
- React Router has CSRF issue in Action/Server Action Request Processing (7.12.0) — [security advisory](https://github.com/advisories/GHSA-H5CW-625J-3RXH)
- React Router SSR XSS in ScrollRestoration (7.12.0) — [security advisory](https://github.com/advisories/GHSA-8V8X-CX79-35W7)
- React Router vulnerable to XSS via Open Redirects (7.12.0) — [security advisory](https://github.com/advisories/GHSA-2W69-QVJG-HVJX)
- React Router has unexpected external redirect via untrusted paths (6.30.2, 7.9.6) — [security advisory](https://github.com/advisories/GHSA-9JCX-V3WJ-WH4M)