Is there a patch available for CVE-2026-55685?

Yes, a patch is available for CVE-2026-55685. Update the affected software to the latest version immediately.

Red Hat CVE-2026-55685

Q: What is the CVSS score of CVE-2026-55685?

CVE-2026-55685 has a CVSS 4.0 base score of 8.7 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.6%.

EUVD-2026-49634 HIGH

Uncontrolled Resource Consumption (CWE-400)

2026-07-24 https://github.com/remix-run/react-router

GHSA-chx6-hx7r-mcp5

Denial Of Service Red Hat Suse

8.7

CVSS 4.0 · Vendor: https://github.com/remix-run/react-router

Severity by source

Vendor (https://github.com/remix-run/react-router) PRIMARY

8.7 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

SUSE

6.5 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Red Hat

6.5 MEDIUM

qualitative

Primary rating from Vendor (https://github.com/remix-run/react-router).

CVSS VectorVendor: https://github.com/remix-run/react-router

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Updated

Jul 27, 2026 - 22:27 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Jul 27, 2026 - 22:22 vuln.today

cvss_changed

CVSS changed

Jul 27, 2026 - 22:22 NVD

8.7 (HIGH)

Source Code Evidence Fetched

Jul 26, 2026 - 11:50 vuln.today

Analysis Generated

Jul 26, 2026 - 11:50 vuln.today

CVE Published

Jul 24, 2026 - 14:06 cve.org

HIGH

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

7 npm packages depend on react-router (3 direct, 4 indirect)

Ecosystem-wide dependent count for version 7.0.0.

DescriptionCVE.org

This is a follow up to https://github.com/remix-run/react-router/security/advisories/GHSA-8x6r-g9mw-2r78 that covers additional reported scenarios in which the manifest endpoint could be accessed via unauthenticated targeted requests that would put heavy load on the server and slow down response times.

> [!NOTE] > This only impacts Framework Mode applications. This does not impact your application if you are using Declarative or Data Mode.

AnalysisAI

Denial of Service in React Router 7.x (Framework Mode) allows unauthenticated attackers to send crafted requests to the manifest endpoint, causing heavy server load and degraded response times. This is a follow-up CWE-400 vulnerability to GHSA-8x6r-g9mw-2r78, affecting only Framework Mode applications using react-router versions 7.0.0 through 7.17.x. A patch is available in version 7.18.0.

Same weakness CWE-400 – Uncontrolled Resource Consumption

View all

CVE-2023-44487 HIGH POC

7.5

CVE-2026-45498 HIGH POC

7.5

CVE-2016-8610 HIGH

7.5

CVE-2026-28318 HIGH POC

7.5

7.5

7.5

7.5

7.5

Same technique Denial Of Service

View all

CVE-2015-5119 CRITICAL POC

9.8

CVE-2011-2462 CRITICAL POC

9.8

CVE-2011-0611 HIGH POC

8.8

CVE-2012-1889 HIGH POC

8.8

CVE-2012-0507 CRITICAL POC

9.8

CVE-2014-1761 HIGH POC

7.8

CVE-2015-5122 CRITICAL POC

9.8

CVE-2011-0609 HIGH POC

7.8

Vendor StatusVendor

SUSE

Severity: Moderate

Product	Status
SUSE Linux Enterprise Module for Package Hub 15 SP7	Affected
SUSE Linux Enterprise Module for SAP Applications 15 SP7	Affected
SUSE Linux Enterprise Server 16.0	Affected
SUSE Linux Enterprise Server for SAP Applications 15 SP7	Affected
SUSE Linux Enterprise Server for SAP applications 16.0	Affected

CVE-2026-55685 vulnerability details – vuln.today

Back

Red Hat CVE-2026-55685

Severity by source

CVSS VectorVendor: https://github.com/remix-run/react-router

Lifecycle Timeline

Blast Radius

DescriptionCVE.org

AnalysisAI

Same weakness CWE-400 – Uncontrolled Resource Consumption

Same technique Denial Of Service

Vendor StatusVendor

SUSE

Share

External POC / Exploit Code