# CVE-2025-68470: React Router unexpected external redirect via untrusted paths

Source: https://junglewise.ai/threats/cve-2025-68470-react-router-unexpected-external-redirect-via-untrusted-paths  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-01-08. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2025-68470 · Severity: low · CVSS 3.1 · Published 2026-01-08

React Router is a JavaScript library that enables client-side navigation in web applications. A vulnerability in the routing logic allows applications that use untrusted user-supplied data in navigation operations to unexpectedly redirect users to external websites. An attacker could exploit this by injecting malicious paths into the application, causing victim users to be redirected away from the legitimate application to attacker-controlled sites for phishing or credential theft.

Technologies: [React-Router](https://junglewise.ai/threats/technologies/npm-react-router).

## Quick answers

**Is CVE-2025-68470 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2025-68470 being exploited in the wild.

**How severe is CVE-2025-68470?** Low severity, with a CVSS score of 3.1, published 8 January 2026.

**Which products and versions are affected?** React-Router SEMVER:introduced=6.0.0,fixed=6.30.2.

**Is there a fix for CVE-2025-68470?** Yes. React-Router: upgrade to 6.30.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2025-68470 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2025-68470?** Check whether you run React-Router at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- React-Router: upgrade to 6.30.2 or later

## Technical details

The vulnerability is an open redirect (CWE-601) in React Router's path handling logic. When an application passes untrusted content into navigation functions such as navigate(), the <Link> component, or redirect(), an attacker can craft a specially-formed path that causes the application to navigate to an external URL instead of an internal route. The attack requires that the application developer passes attacker-controlled data directly into navigation paths without proper validation. Network-accessible applications using vulnerable versions (6.0.0–6.30.1 or 7.0.0–7.9.5) and accepting user-controlled routing parameters are affected. Patches are available in versions 6.30.2 and 7.9.6 or later.

## Affected products

- Remix React Router 6.0.0 to 6.30.1, 7.0.0 to 7.9.5

## Identifiers

- CVE-2025-68470
- GHSA-9jcx-v3wj-wh4m

## Timeline

- 2026-01-08: disclosed: GHSA-9jcx-v3wj-wh4m published
- 2026-01-08: patched: Fixes released in versions 6.30.2 and 7.9.6

## References

- [https://github.com/remix-run/react-router/security/advisories/GHSA-9jcx-v3wj-wh4m](https://github.com/remix-run/react-router/security/advisories/GHSA-9jcx-v3wj-wh4m)

## Related threats

- [remix-run react-router resource consumption in manifest endpoint](https://junglewise.ai/threats/cve-2026-55685-remix-run-react-router-resource-consumption-in-manifest-endpoint)
- [Remix React Router open redirect in Link and useNavigate](https://junglewise.ai/threats/cve-2026-53669-remix-react-router-open-redirect-in-link-and-usenavigate)
- [remix-run React Router improper protocol validation in RSCErrorHandler](https://junglewise.ai/threats/cve-2026-53667-remix-run-react-router-improper-protocol-validation-in)
- [remix-run React Router unsafe reflection in SSR hydration](https://junglewise.ai/threats/cve-2026-53666-remix-run-react-router-unsafe-reflection-in-ssr-hydration)
- [React Router CSRF bypass in RSC mode](https://junglewise.ai/threats/react-router-csrf-bypass-in-rsc-mode-0018662d)