Is CVE-2026-42211 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-42211 being exploited in the wild.

How severe is CVE-2026-42211?

High severity, with a CVSS score of 8.1, published 2 June 2026.

Which products and versions are affected?

React-Router SEMVER:introduced=7.0.0,fixed=7.14.2.

Is there a fix for CVE-2026-42211?

Yes. React-Router: upgrade to 7.14.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-42211 attacked?

It is attacked over the network.

Am I affected by CVE-2026-42211?

Check whether you run React-Router at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-42211: React Router remote code execution in Framework Mode

CVE-2026-42211 · Severity: high · CVSS 8.1 · Published 2026-06-02

React Router is a popular routing library for React applications. When using React Router v7 in Framework Mode (server-side rendering), a flaw in the bundled turbo-stream library allows attackers to execute arbitrary code on the server. However, the attack requires a pre-existing vulnerability in the application code (prototype pollution), and only affects Framework Mode—not applications using Declarative or Data Mode. This could allow an attacker to compromise the web server and access sensitive data.

Technologies: React-Router.

Quick answers

Is CVE-2026-42211 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-42211 being exploited in the wild.
How severe is CVE-2026-42211?: High severity, with a CVSS score of 8.1, published 2 June 2026.
Which products and versions are affected?: React-Router SEMVER:introduced=7.0.0,fixed=7.14.2.
Is there a fix for CVE-2026-42211?: Yes. React-Router: upgrade to 7.14.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-42211 attacked?: It is attacked over the network.
Am I affected by CVE-2026-42211?: Check whether you run React-Router at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

React-Router: upgrade to 7.14.2 or later

Technical details

React Router v7 in Framework Mode vendors turbo-stream v2, which deserializes untrusted data without proper validation (CWE-502). The vulnerability allows arbitrary constructor invocation through TYPE_ERROR deserialization. An attacker must first trigger an existing prototype pollution vulnerability in the application code, then leverage this in a two-step attack to invoke the deserialization flaw and achieve unauthorized RCE on the remote server. The attack is network-accessible but requires high attack complexity. Framework Mode specifically is affected; Declarative Mode and Data Mode are not impacted. The vulnerability is patched in React Router v7.14.2 and later.

Affected products

Remix React Router 7.0.0 to 7.14.1

Identifiers

CVE-2026-42211
GHSA-49rj-9fvp-4h2h

Timeline

2026-06-03: disclosed: Advisory published
2026-06-03: patched: Patched in React Router v7.14.2

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.