CVE-2026-55685

Analyzed Analyzed - Analysis Complete

Manifest Endpoint Denial of Service in React Router

Publication date: 2026-07-27

Last updated on: 2026-08-03

Assigner: GitHub, Inc.

Description

React Router is a router for React. In versions 7.0.0 through 7.17.0, the manifest endpoint could be accessed via unauthenticated targeted requests that would put heavy load on the server and slow down response times. This issue is a follow up to CVE-2026-42342, and does not does not impact React Router applications using Declarative Mode (<BrowserRouter>) or Data Mode (createBrowserRouter/<RouterProvider>). This issue has been fixed in version 7.18.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-27

Last Modified

2026-08-03

Generated

2026-08-17

AI Q&A

2026-07-28

EPSS Evaluated

2026-08-15

NVD

CVE-2026-55685

Affected Vendors & Products

Vendor	Product	Version / Range
shopify	react-router	From 7.0.0 (inc) to 7.18.0 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-400	The product does not properly control the allocation and maintenance of a limited resource.
CWE-407	An algorithm in a product has an inefficient worst-case computational complexity that may be detrimental to system performance and can be triggered by an attacker, typically using crafted manipulations that ensure that the worst case is being reached.

Attack-Flow Graph

Executive Summary

React Router versions 7.0.0 through 7.17.0 have a vulnerability where the manifest endpoint can be accessed via unauthenticated requests. This causes heavy server load and slows down response times. It does not affect applications using Declarative Mode or Data Mode.

Detection Guidance

This vulnerability can be detected by checking if your React Router version is between 7.0.0 and 7.17.0. Use the command 'npm list react-router' or 'yarn list react-router' to check the installed version. If the version is within the affected range, update to version 7.18.0 or later.

Impact Analysis

This vulnerability can degrade server performance due to increased load from unauthenticated requests, potentially causing slower response times or service disruptions for legitimate users.

Compliance Impact

The vulnerability could impact compliance by potentially causing service disruptions due to server overload, which may affect availability requirements in standards like GDPR (Article 32) and HIPAA (Security Rule). However, the specific impact depends on the application's use case and data handling.

Mitigation Strategies

Upgrade React Router to version 7.18.0 or later to address the vulnerability. Ensure applications using React Router are configured with Declarative Mode (<BrowserRouter>) or Data Mode (createBrowserRouter/<RouterProvider>) as these modes are not impacted by the issue.

Hi! I’m here to help you understand CVE-2026-55685. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70