Is CVE-2025-68470 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2025-68470 being exploited in the wild.

How severe is CVE-2025-68470?

Low severity, with a CVSS score of 3.1, published 8 January 2026.

Which products and versions are affected?

React-Router SEMVER:introduced=6.0.0,fixed=6.30.2.

Is there a fix for CVE-2025-68470?

Yes. React-Router: upgrade to 6.30.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2025-68470 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2025-68470?

Check whether you run React-Router at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2025-68470: React Router unexpected external redirect via untrusted paths

CVE-2025-68470 · Severity: low · CVSS 3.1 · Published 2026-01-08

React Router is a JavaScript library that enables client-side navigation in web applications. A vulnerability in the routing logic allows applications that use untrusted user-supplied data in navigation operations to unexpectedly redirect users to external websites. An attacker could exploit this by injecting malicious paths into the application, causing victim users to be redirected away from the legitimate application to attacker-controlled sites for phishing or credential theft.

Technologies: React-Router.

Quick answers

Is CVE-2025-68470 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2025-68470 being exploited in the wild.
How severe is CVE-2025-68470?: Low severity, with a CVSS score of 3.1, published 8 January 2026.
Which products and versions are affected?: React-Router SEMVER:introduced=6.0.0,fixed=6.30.2.
Is there a fix for CVE-2025-68470?: Yes. React-Router: upgrade to 6.30.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2025-68470 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2025-68470?: Check whether you run React-Router at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

React-Router: upgrade to 6.30.2 or later

Technical details

The vulnerability is an open redirect (CWE-601) in React Router's path handling logic. When an application passes untrusted content into navigation functions such as navigate(), the <Link> component, or redirect(), an attacker can craft a specially-formed path that causes the application to navigate to an external URL instead of an internal route. The attack requires that the application developer passes attacker-controlled data directly into navigation paths without proper validation. Network-accessible applications using vulnerable versions (6.0.0–6.30.1 or 7.0.0–7.9.5) and accepting user-controlled routing parameters are affected. Patches are available in versions 6.30.2 and 7.9.6 or later.

Affected products

Remix React Router 6.0.0 to 6.30.1, 7.0.0 to 7.9.5

Identifiers

CVE-2025-68470
GHSA-9jcx-v3wj-wh4m

Timeline

2026-01-08: disclosed: GHSA-9jcx-v3wj-wh4m published
2026-01-08: patched: Fixes released in versions 6.30.2 and 7.9.6

References

https://github.com/remix-run/react-router/security/advisories/GHSA-9jcx-v3wj-wh4m

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.