Vendor
remix-run
- article · all time
- 1
- CVEs tracked · all time
- 4
One article so far, 4 Jun. A pattern appears once more outlets cover remix-run.
Products: @remix-run/server-runtime, react-router, turbo-stream
CVEs
4 CVEsCVE-2026-42211React Router's vendored turbo-stream v2 allows arbitrary constructor invocation via TYPE_ERROR deserialization leading to Unauth RCECVSS8.1High–Not in KEV0.4%EPSS1article
CVE-2026-33245React Router vulnerable to XSS in unstable RSC redirect handling via javascript: redirect targetsCVSS8.0High–Not in KEV0.2%EPSS1article
CVE-2026-42342React Router vulnerable to DoS via unbounded path expansion in __manifest endpointCVSS7.5High–Not in KEV0.3%EPSS1article
CVE-2026-34077React Router vulnerable to Denial of Service via reflected user input in single-fetchCVSS7.5High–Not in KEV0.5%EPSS1article
- Critical React Router Flaws Expose Apps to Remote Code ExecutionSecurityOnline · first in our coverage