CVE-2026-53667

Analyzed Analyzed - Analysis Complete

React Router RSC Protocol Validation Bypass

Publication date: 2026-07-27

Last updated on: 2026-08-03

Assigner: GitHub, Inc.

Description

React Router is a router for React. In versions 7.11.0 through 7.17.0, the RSCErrorHandler is missing protocol validation, allowing for redirects from untrusted sources. This issue is a follow up to CVE-2026-53667, and only affects consuming applications if they are using the unstable RSC APIs. This issue has been fixed in version 7.18.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-27

Last Modified

2026-08-03

Generated

2026-08-17

AI Q&A

2026-07-28

EPSS Evaluated

2026-08-15

NVD

CVE-2026-53667

Affected Vendors & Products

Vendor	Product	Version / Range
shopify	react-router	From 7.11.0 (inc) to 7.18.0 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-79	The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

Executive Summary

React Router versions 7.11.0 through 7.17.0 have a missing protocol validation in the RSCErrorHandler. This allows redirects from untrusted sources, which could lead to malicious redirects if the unstable RSC APIs are used.

Detection Guidance

This vulnerability affects React Router versions 7.11.0 through 7.17.0 using unstable RSC APIs. Check your React Router version with npm list react-router or grep package.json. If using 7.11.0-7.17.0, inspect code for RSCErrorHandler usage.

Impact Analysis

If you are using React Router versions 7.11.0 to 7.17.0 with the unstable RSC APIs, this vulnerability could allow attackers to redirect users to malicious websites, potentially leading to phishing attacks or unauthorized access.

Compliance Impact

The vulnerability involves missing protocol validation in RSCErrorHandler, enabling redirects from untrusted sources. This could potentially lead to unauthorized data exposure or manipulation, which may impact compliance with GDPR (data protection) or HIPAA (healthcare data privacy) if exploited in affected applications.

Mitigation Strategies

Upgrade React Router to version 7.18.0 or later immediately. Remove or replace any usage of unstable RSC APIs in your application. Review redirects in your codebase to ensure they only come from trusted sources.

Hi! I’m here to help you understand CVE-2026-53667. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70