Description
React Router is a router for React. In versions 7.0.0 through 7.17.0, the manifest endpoint could be accessed via unauthenticated targeted requests that would put heavy load on the server and slow down response times. This issue is a follow up to CVE-2026-42342, and does not does not impact React Router applications using Declarative Mode (<BrowserRouter>) or Data Mode (createBrowserRouter/<RouterProvider>). This issue has been fixed in version 7.18.0.
Affected products
shopify: react-router
References6
- github.com/remix-run/react-router/commit/09e6020d1950e54f361f7a… Patch
- github.com/remix-run/react-router/pull/15186 Issue TrackingPatch
- github.com/remix-run/react-router/blob/main/CHANGELOG.md#v7180 Release Notes
- github.com/remix-run/react-router/releases/tag/[email protected]… Release Notes
- github.com/remix-run/react-router/security/advisories/GHSA-8x6r… Third Party Advisory
- github.com/remix-run/react-router/security/advisories/GHSA-chx6… Third Party Advisory
Metrics
- CVSS 3.1
-
7.5
HIGH
Score source: NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - CVSS 4.0
-
8.7
HIGH
Score source: CNA
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - EPSS — exploit probability
- 1% percentile: 54 · as of 13 November 2026
- CWE
- CWE-400CWE-407
Could this be exploited in your environment?
A patch closes the known hole. A penetration test shows what an attacker can still reach — with proof.