What is the CVSS score of EUVD-2026-33999?

EUVD-2026-33999 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of React Router are affected by EUVD-2026-33999?

React Router versions 7.0.0 through 7.14.1 running in Framework Mode contain an unauthenticated remote code execution vulnerability that could allow attackers to execute arbitrary code on affected…. A patch is available.

Is there a public PoC exploit available for EUVD-2026-33999?

Yes, a public proof-of-concept exploit is available for EUVD-2026-33999. Prioritise patching immediately. EPSS: 0.3%.

How to fix or mitigate EUVD-2026-33999?

24 hours: Audit all React Router instances to identify deployments using Framework Mode with versions 7.0.0-7.14.1. 7 days: Implement interim mitigations including network isolation of affected applications, Web Application Firewall rules targeting prototype pollution attacks, and restrict high-risk application features. 30 days: Upgrade to patched version upon vendor release or migrate affected applications to unaffected deployment modes (BrowserRouter or RouterProvider).

React Router EUVD-2026-33999

| CVE-2026-42211 HIGH

Deserialization of Untrusted Data (CWE-502)

2026-06-02 GitHub_M

GHSA-49rj-9fvp-4h2h

RCE Deserialization React Router

8.1

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

8.1 HIGH

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

SUSE

HIGH

qualitative

Primary rating from GitHub Advisory.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Patch available

Jun 02, 2026 - 21:02 EUVD

Analysis Generated

Jun 02, 2026 - 20:22 vuln.today

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

6 npm packages depend on react-router (3 direct, 3 indirect)

Ecosystem-wide dependent count for version 7.0.0.

DescriptionGitHub Advisory

React Router is a router for React. In versions 7.0.0 through 7.14.1, when using Framework Mode, a combination of steps could potentially allow unauthorized remote code execution (RCE) through external requests. This attack requires the application code to have an existing prototype pollution vulnerability, which can then be leveraged in a 2-step attack where the second step triggers unauthorized RCE on the remote server. This does not impact applications using Declarative Mode (<BrowserRouter>) or Data Mode (createBrowserRouter/<RouterProvider>). This is patched in version 7.14.2.

AnalysisAI

Remote code execution in React Router 7.0.0 through 7.14.1 affects applications running in Framework Mode by chaining an application-level prototype pollution flaw with router internals to achieve unauthenticated RCE on the server. Applications using Declarative Mode (BrowserRouter) or Data Mode (createBrowserRouter/RouterProvider) are unaffected. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Recommended ActionAI

24 hours: Audit all React Router instances to identify deployments using Framework Mode with versions 7.0.0-7.14.1. …

Threat intelligence, references, and detailed analysis are available after sign-in.

Vendor StatusVendor

SUSE

Severity: High

Product	Status
SUSE Linux Enterprise Module for Package Hub 15 SP7	Fixed
SUSE Linux Enterprise Module for SAP Applications 15 SP7	Fixed
SUSE Linux Enterprise Server 16.0	Fixed
SUSE Linux Enterprise Server for SAP Applications 15 SP7	Fixed
SUSE Linux Enterprise Server for SAP applications 16.0	Fixed

EUVD-2026-33999 vulnerability details – vuln.today

Back

React Router EUVD-2026-33999

Severity by source

CVSS VectorGitHub Advisory

Lifecycle Timeline

Blast Radius

DescriptionGitHub Advisory

AnalysisAI

Unlock full vulnerability intelligence

Recommended ActionAI

Vendor StatusVendor

SUSE

Share

External POC / Exploit Code