What is the CVSS score of CVE-2026-42342?

CVE-2026-42342 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.1%.

Which versions of React Router are affected by CVE-2026-42342?

React Router versions 7.0.0-7.14.x and @remix-run/server-runtime 2.10.0-2.17.4 are vulnerable to denial-of-service attacks that exhaust server resources through crafted requests, affecting…. A patch is available.

Is there a public PoC exploit available for CVE-2026-42342?

Yes, a public proof-of-concept exploit is available for CVE-2026-42342. Prioritise patching immediately. EPSS: 0.1%.

How to fix or mitigate CVE-2026-42342?

Within 24 hours: Inventory all applications using React Router 7.0.0-7.14.x and @remix-run/server-runtime 2.10.0-2.17.4; identify which are running in Framework Mode or Remix (Declarative and Data Modes are not affected). Within 7 days: Upgrade React Router to 7.15.0 or later and @remix-run/server-runtime to 2.17.5 or later across all affected applications. Within 30 days: Validate all upgrades function correctly in production and complete change documentation.

React Router CVE-2026-42342

EUVD-2026-34000 HIGH

Uncontrolled Resource Consumption (CWE-400)

2026-06-02 GitHub_M

GHSA-8x6r-g9mw-2r78

Denial Of Service React Router Remix Run Server Runtime

7.5

CVSS 3.1 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

SUSE

HIGH

qualitative

Red Hat

6.5 MEDIUM

qualitative

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Patch available

Jun 02, 2026 - 21:02 EUVD

Analysis Generated

Jun 02, 2026 - 20:21 vuln.today

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

85 npm packages depend on @remix-run/server-runtime (78 direct, 7 indirect)
7 npm packages depend on react-router (3 direct, 4 indirect)

Ecosystem-wide dependent count for version 2.10.0 and other introduced versions.

DescriptionCVE.org

React Router is a router for React. In versions 7.0.0 through 7.14.x of react-router and versions 2.10.0 through 2.17.4 of @remix-run/server-runtime, certain crafted requests can consume disproportionate server resources via unbounded path expansion in the __manifest endpoint, resulting in response time degradation and/or service unavailability for end users. This affects React Router Framework Mode applications as well as Remix applications. This does not impact applications using Declarative Mode (<BrowserRouter>) or Data Mode (createBrowserRouter/<RouterProvider>). This is patched in react-router version 7.15.0 and @remix-run/server-runtime version 2.17.5.

AnalysisAI

Denial of service in React Router 7.0.0-7.14.x and @remix-run/server-runtime 2.10.0-2.17.4 allows remote unauthenticated attackers to exhaust server resources by sending crafted requests to the __manifest endpoint, which triggers unbounded path expansion. Only applications running in React Router Framework Mode or Remix are affected; Declarative Mode (<BrowserRouter>) and Data Mode (createBrowserRouter) deployments are not. No public exploit identified at time of analysis, and the issue is patched in react-router 7.15.0 and @remix-run/server-runtime 2.17.5.

Technical ContextAI

React Router is a widely deployed routing library for React, and @remix-run/server-runtime is the server-side runtime that backs Remix and React Router Framework Mode applications. The vulnerability lives in the __manifest endpoint, which is exposed by the server runtime to deliver route manifest metadata to the client; the handler processes paths supplied in the request without bounding the expansion work performed against them. This maps to CWE-400 (Uncontrolled Resource Consumption): a small attacker input is amplified into disproportionate CPU and/or memory work on the server, slowing or stalling legitimate request handling. The affected CPEs are cpe:2.3:a:remix-run:react-router and cpe:2.3:a:remix-run:@remix-run/server-runtime, with semantics tied specifically to Framework/Remix deployment modes rather than client-only routing modes.

RemediationAI

Vendor-released patch: upgrade react-router to 7.15.0 or later, and upgrade @remix-run/server-runtime to 2.17.5 or later, per the GitHub Security Advisory at https://github.com/remix-run/react-router/security/advisories/GHSA-8x6r-g9mw-2r78. If immediate upgrade is not feasible, compensating controls include blocking or rate-limiting requests to the /__manifest endpoint at the edge (CDN, WAF, or reverse proxy) - note this will break client-side route manifest fetching and force full page loads for navigation, degrading SPA behavior. Alternatively, restrict the endpoint to known good path patterns and short query lengths, or front the app with a request size/CPU budget mechanism; teams that can switch to Declarative or Data Mode entirely avoid the affected code path but that is a non-trivial application refactor.

More in React Router

View all

CVE-2026-42211 HIGH This Week POC

8.1 Jun 02

Remote code execution in React Router 7.0.0 through 7.14.1 affects applications running in Framework Mode by chaining an

CVE-2026-34077 HIGH This Week POC

7.5 Jun 02

Client-side Cross-Site Scripting in React Router 7.7.0 through 7.13.1 affects applications using the unstable React Serv

CVE-2026-40181 MEDIUM This Month POC

6.6 Jun 02

Open redirect in React Router's programmatic `redirect()` function allows unauthenticated remote attackers to redirect u

CVE-2026-21884 HIGH This Week

8.2 Jan 10

React Router is a router for React. In @remix-run/react version prior to 2.17.3. [CVSS 8.2 HIGH]

CVE-2025-59057 HIGH This Week

7.6 Jan 10

React Router is a router for React. In @remix-run/react versions 1.15.0 through 2.17.0. [CVSS 7.6 HIGH]

CVE-2025-68470 MEDIUM This Month

6.5 Jan 10

React-Router versions up to 6.30.1 is affected by url redirection to untrusted site (open redirect) (CVSS 6.5).

CVE-2026-22030 MEDIUM This Month

6.5 Jan 10

React Router is a router for React. In @remix-run/server-runtime version prior to 2.17.3. [CVSS 6.5 MEDIUM]

CVE-2026-22029 MEDIUM This Month

6.1 Jan 10

React Router is a router for React. In @remix-run/router version prior to 1.23.2. [CVSS 8.0 HIGH]

CVE-2026-33244 MEDIUM This Month

5.4 Jun 02

Cross-site scripting in React Router's Framework Mode (versions 7.5.1-7.13.1) allows an authenticated attacker with infl

CVE-2026-33245 MEDIUM This Month

4.7 Jun 02

Client-side cross-site scripting in React Router 7.7.0 through 7.13.1 allows remote attackers to execute arbitrary scrip

Same weakness CWE-400 – Uncontrolled Resource Consumption

View all

CVE-2023-44487 HIGH POC

7.5

CVE-2026-45498 HIGH POC

7.5

CVE-2016-8610 HIGH

7.5

CVE-2026-28318 HIGH POC

7.5

7.5

7.5

7.5

7.5

Same technique Denial Of Service

View all

CVE-2015-5119 CRITICAL POC

9.8

CVE-2011-2462 CRITICAL POC

9.8

CVE-2011-0611 HIGH POC

8.8

CVE-2012-1889 HIGH POC

8.8

CVE-2012-0507 CRITICAL POC

9.8

CVE-2014-1761 HIGH POC

7.8

CVE-2015-5122 CRITICAL POC

9.8

CVE-2011-0609 HIGH POC

7.8

Vendor StatusVendor

SUSE

Severity: High

Product	Status
SUSE Linux Enterprise Module for Package Hub 15 SP7	Fixed
SUSE Linux Enterprise Module for SAP Applications 15 SP7	Fixed
SUSE Linux Enterprise Server 16.0	Fixed
SUSE Linux Enterprise Server for SAP Applications 15 SP7	Fixed
SUSE Linux Enterprise Server for SAP applications 16.0	Fixed

CVE-2026-42342 vulnerability details – vuln.today

Back

React Router CVE-2026-42342

Severity by source

CVSS VectorVendor: GitHub_M

Lifecycle Timeline

Blast Radius

DescriptionCVE.org

AnalysisAI

Technical ContextAI

RemediationAI

More in React Router

Same weakness CWE-400 – Uncontrolled Resource Consumption

Same technique Denial Of Service

Vendor StatusVendor

SUSE

Share

External POC / Exploit Code