Executive brief
React Router is a popular routing library for React applications that manages navigation and URL handling. When using the redirect function in non-declarative mode, specially crafted URLs starting with double slashes (//) can be misinterpreted as protocol-relative URLs, allowing attackers to redirect users to external websites. This could be exploited to direct users to phishing sites or malicious domains if an application does not properly validate redirect destinations.
Technical details
The vulnerability is an open redirect (CWE-601) affecting React Router's redirect function. The root cause is improper handling of URLs starting with // (protocol-relative URLs), which the redirect function treats as same-origin when they should be normalized. An attacker can pass a malicious URL like //attacker.com to the redirect function, and depending on application-level validation, the browser will interpret this as a protocol-relative URL and redirect to an external domain using the current page's protocol. The attack requires the application to be using non-declarative routing mode (imperative redirect calls rather than <BrowserRouter>) and depends on insufficient URL validation by the application before passing to redirect. The vulnerability is fixed in react-router 6.30.4+ and 7.14.1+, as well as @remix-run/router 1.23.3+, which normalize double slashes in redirect paths.
Affected products
- Remix Run react-router 6.7.0 to 6.30.3, 7.0.0 to 7.14.0
- Remix Run @remix-run/router 1.3.0 to 1.23.2
Timeline
- 2026-06-02: disclosed: GHSA-2j2x-hqr9-3h42 published
- 2026-06: patched: Fixed in react-router 6.30.4, 7.14.1 and @remix-run/router 1.23.3