React Router CVE-2026-53666

React Router's SSR hydration pipeline serializes server-side errors into the window.__staticRouterHydrationData payload, which the client-side runtime then deserializes during hydration. Prior to the fix, the undocumented deserializeErrors() function used __type and __subType string fields from this payload to look up and invoke constructor functions present on the global window object - a classic unsafe reflection pattern (CWE-470: Use of Externally-Controlled Input to Select Classes or Code). If attacker-controlled input could reach and overwrite these fields in the server-rendered error object, the client would instantiate an arbitrary class (such as XMLHttpRequest or a custom constructor on window), producing unintended outbound network traffic. The PR diff confirms two distinct remediation paths: Framework Mode now uses turbo-stream for safe error serialization, while Data Mode removes the undocumented custom serialization entirely. The affected package is pkg:npm/react-router, versions >= 6.4.0 and < 7.18.0.