What is the CVSS score of EUVD-2026-33994?

EUVD-2026-33994 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.0%.

Which versions of React Router are affected by EUVD-2026-33994?

React Router versions 7.7.0 through 7.13.1 contain a client-side XSS vulnerability in React Server Components that allows attackers to inject scripts through unvalidated redirect destinations.. A patch is available.

Is there a public PoC exploit available for EUVD-2026-33994?

Yes, a public proof-of-concept exploit is available for EUVD-2026-33994. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate EUVD-2026-33994?

24 hours: Inventory all applications using React Router 7.7.0-7.13.1, with priority on those implementing React Server Components APIs. 7 days: Upgrade all affected deployments to React Router 7.13.2 or later and validate RSC functionality across test environments. 30 days: Confirm patch application across all production and non-production environments; document remediation timeline and testing results.

React Router EUVD-2026-33994

| CVE-2026-34077 HIGH

Allocation of Resources Without Limits or Throttling (CWE-770)

2026-06-02 GitHub_M

GHSA-rxv8-25v2-qmq8

XSS Denial Of Service React Router Turbo Stream

7.5

CVSS 3.1 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

SUSE

HIGH

qualitative

Red Hat

6.5 MEDIUM

qualitative

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Patch available

Jun 02, 2026 - 21:02 EUVD

Analysis Generated

Jun 02, 2026 - 20:22 vuln.today

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

7 npm packages depend on react-router (3 direct, 4 indirect)

Ecosystem-wide dependent count for version 7.0.0.

DescriptionCVE.org

React Router is a router for React. In versions 7.7.0 through 7.13.1, when using React Router's unstable React Server Components (RSC) APIs, there is a potential client-side Cross-Site Scripting (XSS) vulnerability in the RSC redirect handling if redirects come from untrusted sources. This does not impact applications that are not using the unstable RSC APIs in React Router. This is patched in version 7.13.2.

AnalysisAI

Client-side Cross-Site Scripting in React Router 7.7.0 through 7.13.1 affects applications using the unstable React Server Components (RSC) APIs, where redirect handling fails to sanitize destinations originating from untrusted sources. An attacker who can influence redirect targets consumed by RSC handlers may inject script payloads that execute in the victim's browser, with no public exploit identified at time of analysis. The advisory is published as GHSA-rxv8-25v2-qmq8 and the issue is fixed in 7.13.2.

Technical ContextAI

React Router is the dominant client-side routing library for React applications, maintained by Remix Run, and the affected code path lives in its experimental React Server Components integration. RSC redirects are serialized server-to-client instructions that tell the client runtime to navigate to a new URL; in the affected versions the redirect target is trusted without validation, which is the structural pattern behind CWE-770 (Allocation of Resources Without Limits or Throttling) as classified, though the practical effect described by the maintainers is reflected XSS via attacker-controlled redirect destinations (e.g., javascript: URIs or markup that becomes part of a client-rendered context). The CPE data covers cpe:2.3:a:remix-run:react-router and cpe:2.3:a:remix-run:turbo-stream, the latter being the streaming serialization library RSC builds on, suggesting the unsafe handling traverses both packages.

RemediationAI

Vendor-released patch: React Router 7.13.2 - upgrade react-router (and any pinned turbo-stream dependency resolved through it) to 7.13.2 or later as the primary fix, per https://github.com/remix-run/react-router/security/advisories/GHSA-rxv8-25v2-qmq8. If immediate upgrade is not possible, stop sourcing RSC redirect targets from untrusted input: validate any redirect URL against an allowlist of same-origin paths and reject non-http(s) schemes such as javascript:, data:, and vbscript: before passing them to the RSC redirect helper, accepting the trade-off that legitimate cross-origin redirects will need to be enumerated. Teams not yet in production with RSC can also disable or avoid the unstable RSC APIs entirely until they upgrade, which removes the attack surface at the cost of losing RSC functionality.