What is the CVSS score of EUVD-2026-33999?

EUVD-2026-33999 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of React Router are affected by EUVD-2026-33999?

React Router versions 7.0.0 through 7.14.1 running in Framework Mode contain an unauthenticated remote code execution vulnerability that could allow attackers to execute arbitrary code on affected…. A patch is available.

Is there a public PoC exploit available for EUVD-2026-33999?

Yes, a public proof-of-concept exploit is available for EUVD-2026-33999. Prioritise patching immediately. EPSS: 0.3%.

How to fix or mitigate EUVD-2026-33999?

24 hours: Audit all React Router instances to identify deployments using Framework Mode with versions 7.0.0-7.14.1. 7 days: Implement interim mitigations including network isolation of affected applications, Web Application Firewall rules targeting prototype pollution attacks, and restrict high-risk application features. 30 days: Upgrade to patched version upon vendor release or migrate affected applications to unaffected deployment modes (BrowserRouter or RouterProvider).

React Router EUVD-2026-33999

| CVE-2026-42211 HIGH

Deserialization of Untrusted Data (CWE-502)

2026-06-02 GitHub_M

GHSA-49rj-9fvp-4h2h

RCE Deserialization React Router Red Hat

8.1

CVSS 3.1 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

8.1 HIGH

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

SUSE

HIGH

qualitative

Red Hat

8.1 HIGH

qualitative

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Patch available

Jun 02, 2026 - 21:02 EUVD

Analysis Generated

Jun 02, 2026 - 20:22 vuln.today

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

7 npm packages depend on react-router (3 direct, 4 indirect)

Ecosystem-wide dependent count for version 7.0.0.

DescriptionCVE.org

React Router is a router for React. In versions 7.0.0 through 7.14.1, when using Framework Mode, a combination of steps could potentially allow unauthorized remote code execution (RCE) through external requests. This attack requires the application code to have an existing prototype pollution vulnerability, which can then be leveraged in a 2-step attack where the second step triggers unauthorized RCE on the remote server. This does not impact applications using Declarative Mode (<BrowserRouter>) or Data Mode (createBrowserRouter/<RouterProvider>). This is patched in version 7.14.2.

Articles & Coverage 1

jfrog.com Inflated CVSS Scores in Axios Prototype Pollution Gadget CVEs (CVE-2026-42264, CVE-2026-44490, and More) Jul 01, 2026

AnalysisAI

Remote code execution in React Router 7.0.0 through 7.14.1 affects applications running in Framework Mode by chaining an application-level prototype pollution flaw with router internals to achieve unauthenticated RCE on the server. Applications using Declarative Mode (BrowserRouter) or Data Mode (createBrowserRouter/RouterProvider) are unaffected. No public exploit identified at time of analysis; CVSS 8.1 reflects high impact tempered by high attack complexity due to the prerequisite prototype pollution gadget.

More in React Router

View all

CVE-2026-42342 HIGH This Week POC

7.5 Jun 02

Denial of service in React Router 7.0.0-7.14.x and @remix-run/server-runtime 2.10.0-2.17.4 allows remote unauthenticated

CVE-2026-34077 HIGH This Week POC

7.5 Jun 02

Client-side Cross-Site Scripting in React Router 7.7.0 through 7.13.1 affects applications using the unstable React Serv

CVE-2026-40181 MEDIUM This Month POC

6.6 Jun 02

Open redirect in React Router's programmatic `redirect()` function allows unauthenticated remote attackers to redirect u

CVE-2026-21884 HIGH This Week

8.2 Jan 10

React Router is a router for React. In @remix-run/react version prior to 2.17.3. [CVSS 8.2 HIGH]

CVE-2025-59057 HIGH This Week

7.6 Jan 10

React Router is a router for React. In @remix-run/react versions 1.15.0 through 2.17.0. [CVSS 7.6 HIGH]

CVE-2025-68470 MEDIUM This Month

6.5 Jan 10

React-Router versions up to 6.30.1 is affected by url redirection to untrusted site (open redirect) (CVSS 6.5).

CVE-2026-22030 MEDIUM This Month

6.5 Jan 10

React Router is a router for React. In @remix-run/server-runtime version prior to 2.17.3. [CVSS 6.5 MEDIUM]

CVE-2026-22029 MEDIUM This Month

6.1 Jan 10

React Router is a router for React. In @remix-run/router version prior to 1.23.2. [CVSS 8.0 HIGH]

CVE-2026-33244 MEDIUM This Month

5.4 Jun 02

Cross-site scripting in React Router's Framework Mode (versions 7.5.1-7.13.1) allows an authenticated attacker with infl

CVE-2026-33245 MEDIUM This Month

4.7 Jun 02

Client-side cross-site scripting in React Router 7.7.0 through 7.13.1 allows remote attackers to execute arbitrary scrip

Same weakness CWE-502 – Deserialization of Untrusted Data

View all

CVE-2021-35464 CRITICAL POC

9.8

CVE-2020-10189 CRITICAL POC

9.8

CVE-2019-18935 CRITICAL POC

9.8

CVE-2015-7450 CRITICAL POC

9.8

CVE-2025-53770 CRITICAL POC

9.8

CVE-2020-7961 CRITICAL POC

9.8

CVE-2021-42237 CRITICAL POC

9.8

CVE-2025-24016 CRITICAL POC

9.9

Same technique RCE

View all

CVE-2021-44228 CRITICAL POC

10.0

CVE-2017-7269 CRITICAL POC

9.8

CVE-2022-47966 CRITICAL POC

9.8

CVE-2012-4681 CRITICAL POC

9.8

CVE-2023-3519 CRITICAL POC

9.8

CVE-2015-5119 CRITICAL POC

9.8

CVE-2016-4117 CRITICAL POC

9.8

CVE-2015-3113 CRITICAL POC

9.8

Vendor StatusVendor

SUSE

Severity: High

Product	Status
SUSE Linux Enterprise Module for Package Hub 15 SP7	Fixed
SUSE Linux Enterprise Module for SAP Applications 15 SP7	Fixed
SUSE Linux Enterprise Server 16.0	Fixed
SUSE Linux Enterprise Server for SAP Applications 15 SP7	Fixed
SUSE Linux Enterprise Server for SAP applications 16.0	Fixed

EUVD-2026-33999 vulnerability details – vuln.today

Back

React Router EUVD-2026-33999

Severity by source

CVSS VectorVendor: GitHub_M

Lifecycle Timeline

Blast Radius

DescriptionCVE.org

Articles & Coverage 1

AnalysisAI

More in React Router

Same weakness CWE-502 – Deserialization of Untrusted Data

Same technique RCE

Vendor StatusVendor

SUSE

Share

External POC / Exploit Code