Skip to main content

React Router CVE-2026-21884

HIGH
Cross-site Scripting (XSS) (CWE-79)
2026-01-10 security-advisories@github.com GHSA-8v8x-cx79-35w7
XSS React Router Remix Run React Shopify
8.2
CVSS 3.1 · Vendor: github
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Access
    Craft malicious getKey/storageKey prop values
  2. Exploit
    Inject XSS payload into React Router ScrollRestoration
  3. Execution
    Execute arbitrary JavaScript during server-side rendering
  4. Impact
    Compromise application and user data

Vulnerability Assessment

Weakness
CWE
CWE-79
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Output encoding, context-aware escaping
MITRE ATT&CK

2 techniques across 2 tactics: Initial Access, Execution

The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up.

Sign in to read
Exploitation Conditions

React Router Framework Mode with Server-Side Rendering enabled, using untrusted content in <ScrollRestoration> getKey or storageKey props. Affected versions: @remix-run/react < 2.17.3 or react-router 7.0.0–7.11.0. No impact if SSR disabled or Declarative/Data Mode used instead.
Impact

CVSS 8.2 (HIGH). Attack vector: Network. Complexity: Low. Privileges required: None. User interaction: Required.
Exploit ScenarioDerived

An attacker could exploit this vulnerability to arbitrary JavaScript execution during SSR if untrusted content is used to genera.
This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).
Patch available 0.0% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Mar 12, 2026

React Router is a router for React. In @remix-run/react version prior to 2.17.3. [CVSS 8.2 HIGH]

RemediationAI

Monitor vendor advisories for a patch. Implement output encoding and Content Security Policy headers. Restrict network access to the affected service where possible.

Affected Packages

npm @remix-run/react fix: 2.17.3
npm react-router fix: 7.12.0

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 2 packages in npm

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

Classified as CWE-79 (Cross-site Scripting (XSS)). Affects React-Router. React Router is a router for React. In @remix-run/react version prior to 2.17.3. and react-router 7.0.0 through 7.11.0, a XSS vulnerability exists in in React Router's <ScrollRestoration> API in Framework Mode when using the getKey/storageKey props during Server-Side Rendering which could allow arbitrary JavaScript execution during SSR if untrusted content is used to generate the keys. There is no impact if server-side rendering in Framework Mode is disabled, or if Declarative Mode (<BrowserRout

Know when React Router gets its next vulnerability

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (github) PRIMARY 8.2 HIGH
AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N
SUSE HIGH
Red Hat 8.2 HIGH

Primary rating from Vendor (github).

CVSS VectorVendor: github

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
Required
Scope
Changed
Confidentiality
High
Integrity
Low
Availability
None

Lifecycle Timeline

2
Patch released
Mar 31, 2026 - 21:13 nvd
Patch available
CVE Published
Jan 10, 2026 - 03:15 nvd
HIGH 8.2

DescriptionCVE.org

React Router is a router for React. In @remix-run/react version prior to 2.17.3. and react-router 7.0.0 through 7.11.0, a XSS vulnerability exists in in React Router's <ScrollRestoration> API in Framework Mode when using the getKey/storageKey props during Server-Side Rendering which could allow arbitrary JavaScript execution during SSR if untrusted content is used to generate the keys. There is no impact if server-side rendering in Framework Mode is disabled, or if Declarative Mode (<BrowserRouter>) or Data Mode (createBrowserRouter/<RouterProvider>) is being used. This issue has been patched in @remix-run/react version 2.17.3 and react-router version 7.12.0.

Blast Radius

ecosystem impact
† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth
  • 7 npm packages depend on react-router (3 direct, 4 indirect)

Ecosystem-wide dependent count for version 7.0.0.

Executive ViewAI

Why It Matters

Organizations using React Router face notable risk from CVE-2026-21884, a cross-site scripting vulnerability rated CVSS 8.2. Attackers could inject malicious scripts to steal user sessions, credentials, or perform actions on behalf of authenticated users. Organizations should apply vendor updates when available and consider compensating controls in the interim.

Business Impact: High
Compensating Controls

Apply vendor patch. If immediate patching is not feasible: (1) Implement Content-Security-Policy headers; (2) Enable HttpOnly and SameSite cookie attributes; (3) Deploy WAF XSS/CSRF rules.

Threat Intelligence Overview

EPSS Score
0.0%
Top 97% exploitable
Threat Intel
1
1 source
Data Quality
6 sources
Confidence: High
NVD CVE.org EPSS GHSA Vendor GitHub VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity HIGH
CISA KEV No
Public POC No
EPSS 0.0%
Patch available Yes
Active threat No
Deciding rule
HIGH severity (CVSS 7.0-8.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived
Scheduled
Exploitation· derived
None
System Exposure· derived
Open
Automatable· derived
No
Human Impact
High

Priority Score

41
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +41
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Cross-Site Scripting MEDIUM

Cross-Site Scripting occurs when an application accepts untrusted data and sends it to a web browser without proper validation or encoding.

Affected Products (CPE)CVE.org

cpe:2.3:a:shopify:react-router:*:*:*:*:*:node.js:*:*
cpe:2.3:a:shopify:remix-run\/react:*:*:*:*:*:node.js:*:*

More in React Router

View all
CVE-2026-42211 HIGH POC
8.1 Jun 02

Remote code execution in React Router 7.0.0 through 7.14.1 affects applications running in Framework Mode by chaining an
CVE-2026-42342 HIGH POC
7.5 Jun 02

Denial of service in React Router 7.0.0-7.14.x and @remix-run/server-runtime 2.10.0-2.17.4 allows remote unauthenticated
CVE-2026-34077 HIGH POC
7.5 Jun 02

Client-side Cross-Site Scripting in React Router 7.7.0 through 7.13.1 affects applications using the unstable React Serv
CVE-2026-40181 MEDIUM POC
6.6 Jun 02

Open redirect in React Router's programmatic `redirect()` function allows unauthenticated remote attackers to redirect u
CVE-2025-59057 HIGH
7.6 Jan 10

React Router is a router for React. In @remix-run/react versions 1.15.0 through 2.17.0. [CVSS 7.6 HIGH]
CVE-2025-68470 MEDIUM
6.5 Jan 10

React-Router versions up to 6.30.1 is affected by url redirection to untrusted site (open redirect) (CVSS 6.5).
CVE-2026-22030 MEDIUM
6.5 Jan 10

React Router is a router for React. In @remix-run/server-runtime version prior to 2.17.3. [CVSS 6.5 MEDIUM]
CVE-2026-22029 MEDIUM
6.1 Jan 10

React Router is a router for React. In @remix-run/router version prior to 1.23.2. [CVSS 8.0 HIGH]
CVE-2026-33244 MEDIUM
5.4 Jun 02

Cross-site scripting in React Router's Framework Mode (versions 7.5.1-7.13.1) allows an authenticated attacker with infl
CVE-2026-33245 MEDIUM
4.7 Jun 02

Client-side cross-site scripting in React Router 7.7.0 through 7.13.1 allows remote attackers to execute arbitrary scrip

Same weakness CWE-79 – Cross-site Scripting (XSS)

View all
CVE-2020-3580 MEDIUM POC
6.1
CVE-2013-7389 MEDIUM POC
4.3
CVE-2021-25299 MEDIUM POC
6.1
CVE-2014-2120 MEDIUM
6.1
CVE-2023-40000 HIGH POC
8.3
CVE-2016-8581 MEDIUM POC
6.1
CVE-2013-5223 MEDIUM POC
5.4
CVE-2025-52367 MEDIUM POC
5.4

Same technique XSS

View all
CVE-2017-9248 CRITICAL POC
9.8
CVE-2013-1710 CRITICAL POC
10.0
CVE-2024-52875 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: High
Product Status
SUSE Linux Enterprise Module for Package Hub 15 SP7 Fixed
SUSE Linux Enterprise Module for SAP Applications 15 SP7 Fixed
SUSE Linux Enterprise Server 16.0 Fixed
SUSE Linux Enterprise Server 16.0 Fixed
SUSE Linux Enterprise Server 16.1 Fixed

References

Advisories & patches
ADVISORY https://access.redhat.com/errata/RHSA-2026:3782 ADVISORY https://access.redhat.com/errata/RHSA-2026:3958 ADVISORY https://access.redhat.com/errata/RHSA-2026:3960 ADVISORY https://vuldb.com/vuln/340426 REF https://access.redhat.com/errata/RHSA-2026:19712 REF https://access.redhat.com/security/cve/CVE-2026-21884 REF https://bugzilla.redhat.com/show_bug.cgi?id=2428421 REF https://github.com/remix-run/react-router/security/advisories/GHSA-8v8x-cx79-35w7 REF https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-21884.json

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy