remix-run product

react-router

← All remix-run products

No react-router CVE is in the CISA KEV catalogue.

Tracked since 4 Jun · latest article Thu 4 Jun · RSS

Open KEV deadlines: 0; None open
Added to KEV · 90 days: 0; of 0 all time
High exploit odds · current: 0; high · not in KEV
Articles · 7 days: 0; usual rate

Exploited, by due date

CSV download

No react-router CVE is in the CISA KEV catalogue.

Coverage

1 articles · all timeFull timeline →

One article so far, 4 Jun. A pattern appears once more outlets cover react-router.

Thu 4 Jun · first reportCritical React Router Flaws Expose Apps to Remote Code ExecutionSecurityOnline

4 JunCritical React Router Flaws Expose Apps to Remote Code ExecutionSecurityOnline

All CVEs in coverage

CVE-2026-42211React Router's vendored turbo-stream v2 allows arbitrary constructor invocation via TYPE_ERROR deserialization leading to Unauth RCECVSS8.1High–Not in KEV0.4%EPSS1article

CVE-2026-42342React Router vulnerable to DoS via unbounded path expansion in __manifest endpointCVSS7.5High–Not in KEV0.3%EPSS1article

CVE-2026-34077React Router vulnerable to Denial of Service via reflected user input in single-fetchCVSS7.5High–Not in KEV0.3%EPSS1article

CVE-2026-33245React Router vulnerable to XSS in unstable RSC redirect handling via javascript: redirect targetsCVSS8.0High–Not in KEV0.2%EPSS1article

How these numbers are made

CISA KEV counts use the full catalogue, refreshed every 10 minutes. CVEs in coverage are those recorded by CyberSIXT. BOD 22-01 deadlines bind US federal civilian agencies.

CVEs with FIRST EPSS at or above the 95th percentile (top 5%), excluding CVEs in CISA KEV. EPSS estimates exploitation probability over the next 30 days.

Coverage is above its usual rate at three or more articles in 7 days and at least 2.5 times the weekly mean of the preceding 8 weeks.

Product names are grouped by normalised names, with version and edition tails removed.

Fix listed refers to an advisory. Unknown fix status is counted as not listed.

react-router

Exploited, by due date

Coverage

All CVEs in coverage

On this device

Intel

Settings

Keyboard shortcuts