Overview
About vulnerability
React Router is a router for React. In versions 7.11.0 through 7.17.0, the RSCErrorHandler is missing protocol validation, allowing for redirects from untrusted sources. This issue is a follow up to CVE-2026-53667, and only affects consuming applications if they are using the unstable RSC APIs. This issue has been fixed in version 7.18.0.Details
- Affected product:
- React , web-infra-dev/modern.js , zephyr-packages
- Affected packages:
- @react-router/dev @ 7.17.0 (+54 more)