CVE-2026-42342: Remix React Router DoS via unbounded path expansion in __manifest

Executive brief

React Router, a popular library for managing navigation in web applications, is vulnerable to a denial-of-service attack when used in Framework Mode. An attacker can send specially crafted requests to a specific internal endpoint that cause the server to consume excessive resources. This can lead to significant slowdowns or make the application completely unavailable to legitimate users.

Technical details

A vulnerability exists in React Router Framework Mode (and Remix v2.10.0 - 2.17.4) where the __manifest endpoint is susceptible to unbounded path expansion. This is classified as CWE-400: Uncontrolled Resource Consumption. An unauthenticated remote attacker can craft network requests that trigger disproportionate resource usage on the server, leading to service degradation or a complete crash. The issue does not affect applications using Declarative Mode or Data Mode. Patches are available in React Router v7.15.0 and @remix-run/server-runtime v2.17.5.

Affected products

• remix-run react-router >= 7.0.0, < 7.15.0
• remix-run @remix-run/server-runtime >= 2.10.0, < 2.17.5

Timeline

• 2026-06-02: disclosed
• 2026-06-03: advisory

References

• https://api.github.com/users/adrgs
• https://github.com/adrgs
• https://api.github.com/users/adrgs/gists%7B/gist_id%7D
• https://api.github.com/users/adrgs/repos
• https://avatars.githubusercontent.com/u/11564377?v=4
• https://api.github.com/users/adrgs/events%7B/privacy%7D