Executive brief
React Router is a popular routing library for React applications. When using React Router v7 in Framework Mode (server-side rendering), a flaw in the bundled turbo-stream library allows attackers to execute arbitrary code on the server. However, the attack requires a pre-existing vulnerability in the application code (prototype pollution), and only affects Framework Mode—not applications using Declarative or Data Mode. This could allow an attacker to compromise the web server and access sensitive data.
Technical details
React Router v7 in Framework Mode vendors turbo-stream v2, which deserializes untrusted data without proper validation (CWE-502). The vulnerability allows arbitrary constructor invocation through TYPE_ERROR deserialization. An attacker must first trigger an existing prototype pollution vulnerability in the application code, then leverage this in a two-step attack to invoke the deserialization flaw and achieve unauthorized RCE on the remote server. The attack is network-accessible but requires high attack complexity. Framework Mode specifically is affected; Declarative Mode and Data Mode are not impacted. The vulnerability is patched in React Router v7.14.2 and later.
Affected products
- Remix React Router 7.0.0 to 7.14.1
Timeline
- 2026-06-03: disclosed: Advisory published
- 2026-06-03: patched: Patched in React Router v7.14.2