Executive brief
React Router, a popular library for managing navigation in web applications, is vulnerable to a denial-of-service attack when using its Framework Mode or Single Fetch features. An attacker can send specially crafted input that causes the server to spend excessive time processing data, potentially making the website unavailable to legitimate users. This issue specifically affects applications using the newer v7 framework features or Remix v2.9.0+.
Technical details
A Denial of Service vulnerability exists in React Router v7 (Framework Mode) and Remix (v2.9.0+ with Single Fetch enabled) due to inefficient resource allocation during data serialization. The root cause lies in the underlying turbo-stream library's serialization algorithm, which can be forced into a performance bottleneck when encoding specific types of reflected user input into server responses. This is classified as CWE-770 (Allocation of Resources Without Limits or Throttling). An unauthenticated remote attacker can exploit this by sending malicious input that triggers high CPU or memory usage during the 'single-fetch' process. The vulnerability is patched in React Router v7.14.0 and turbo-stream v3.0.0.
Affected products
- Remix React Router >= 7.0.0, < 7.14.0
- Remix Project Remix >= 2.9.0
- jacob-ebey turbo-stream < 3.0.0
Timeline
- 2026-06-02: advisory: NVD publication date
- 2026-06-04: disclosed: GitHub Advisory published