# CVE-2026-40181: Remix React Router open redirect in redirect function

Source: https://junglewise.ai/threats/cve-2026-40181-remix-react-router-open-redirect-in-redirect-function  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-02. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-40181 · Severity: medium · CVSS 4 · Published 2026-06-02

React Router is a popular routing library for React applications that manages navigation and URL handling. When using the redirect function in non-declarative mode, specially crafted URLs starting with double slashes (//) can be misinterpreted as protocol-relative URLs, allowing attackers to redirect users to external websites. This could be exploited to direct users to phishing sites or malicious domains if an application does not properly validate redirect destinations.

Vendors: [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2026-40181 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-40181 being exploited in the wild.

**How severe is CVE-2026-40181?** Medium severity, with a CVSS score of 4, published 2 June 2026.

**Which products and versions are affected?** @remix-run/router (npm) SEMVER:introduced=1.3.0,fixed=1.23.3.

**Is there a fix for CVE-2026-40181?** Yes. @remix-run/router (npm): upgrade to 1.23.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-40181 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-40181?** Check whether you run @remix-run/router (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- @remix-run/router (npm): upgrade to 1.23.3 or later

  ```sh
  npm install @remix-run/router@1.23.3
  ```


## Technical details

The vulnerability is an open redirect (CWE-601) affecting React Router's redirect function. The root cause is improper handling of URLs starting with // (protocol-relative URLs), which the redirect function treats as same-origin when they should be normalized. An attacker can pass a malicious URL like //attacker.com to the redirect function, and depending on application-level validation, the browser will interpret this as a protocol-relative URL and redirect to an external domain using the current page's protocol. The attack requires the application to be using non-declarative routing mode (imperative redirect calls rather than <BrowserRouter>) and depends on insufficient URL validation by the application before passing to redirect. The vulnerability is fixed in react-router 6.30.4+ and 7.14.1+, as well as @remix-run/router 1.23.3+, which normalize double slashes in redirect paths.

## Affected products

- Remix Run react-router 6.7.0 to 6.30.3, 7.0.0 to 7.14.0
- Remix Run @remix-run/router 1.3.0 to 1.23.2

## Identifiers

- CVE-2026-40181
- GHSA-2j2x-hqr9-3h42

## Timeline

- 2026-06-02: disclosed: GHSA-2j2x-hqr9-3h42 published
- 2026-06: patched: Fixed in react-router 6.30.4, 7.14.1 and @remix-run/router 1.23.3

## References

- [https://github.com/remix-run/react-router/security/advisories/GHSA-2j2x-hqr9-3h42](https://github.com/remix-run/react-router/security/advisories/GHSA-2j2x-hqr9-3h42)
- [https://github.com/remix-run/react-router/commit/d77f6b1](https://github.com/remix-run/react-router/commit/d77f6b1)
- [https://github.com/remix-run/react-router](https://github.com/remix-run/react-router)

## Related threats

- [React Router XSS via unsafe SPA navigation redirects](https://junglewise.ai/threats/cve-2026-22029-react-router-xss-via-unsafe-spa-navigation-redirects)