# CVE-2026-42342: Remix React Router DoS via unbounded path expansion in __manifest

Source: https://junglewise.ai/threats/cve-2026-42342-remix-react-router-dos-via-unbounded-path-expansion-in-manifest  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-02. Updated: 2026-06-03  
License: CC BY 4.0 with a link back

CVE-2026-42342 · Severity: high · CVSS 7.5 · Published 2026-06-02

React Router, a popular library for managing navigation in web applications, is vulnerable to a denial-of-service attack when used in Framework Mode. An attacker can send specially crafted requests to a specific internal endpoint that cause the server to consume excessive resources. This can lead to significant slowdowns or make the application completely unavailable to legitimate users.

Technologies: [@remix-run/server-runtime (npm)](https://junglewise.ai/threats/technologies/remix-run-server-runtime), [Remix Server-Runtime](https://junglewise.ai/threats/technologies/server-runtime). Vendors: [npm](https://junglewise.ai/threats/vendors/npm), [Remix](https://junglewise.ai/threats/vendors/remix).

## Quick answers

**Is CVE-2026-42342 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-42342 being exploited in the wild.

**How severe is CVE-2026-42342?** High severity, with a CVSS score of 7.5, published 2 June 2026.

**Which products and versions are affected?** @remix-run/server-runtime (npm) >= 2.10.0, < 2.17.5, SEMVER:introduced=2.10.0,fixed=2.17.5; Remix Server-Runtime >= 2.10.0, < 2.17.5, 2.10.0 - 2.17.4.

**Is there a fix for CVE-2026-42342?** Yes. @remix-run/server-runtime (npm): upgrade to 2.17.5 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-42342 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-42342?** Check whether you run @remix-run/server-runtime (npm) or Remix Server-Runtime at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- @remix-run/server-runtime (npm): upgrade to 2.17.5 or later

  ```sh
  npm install @remix-run/server-runtime@2.17.5
  ```


## Technical details

A vulnerability exists in React Router Framework Mode (and Remix v2.10.0 - 2.17.4) where the __manifest endpoint is susceptible to unbounded path expansion. This is classified as CWE-400: Uncontrolled Resource Consumption. An unauthenticated remote attacker can craft network requests that trigger disproportionate resource usage on the server, leading to service degradation or a complete crash. The issue does not affect applications using Declarative Mode or Data Mode. Patches are available in React Router v7.15.0 and @remix-run/server-runtime v2.17.5.

## Affected products

- remix-run react-router >= 7.0.0, < 7.15.0
- remix-run @remix-run/server-runtime >= 2.10.0, < 2.17.5

## Identifiers

- CVE-2026-42342
- GHSA-8x6r-g9mw-2r78

## Timeline

- 2026-06-02: disclosed
- 2026-06-03: advisory

## References

- [https://api.github.com/users/adrgs](https://api.github.com/users/adrgs)
- [https://github.com/adrgs](https://github.com/adrgs)
- [https://api.github.com/users/adrgs/gists%7B/gist_id%7D](https://api.github.com/users/adrgs/gists%7B/gist_id%7D)
- [https://api.github.com/users/adrgs/repos](https://api.github.com/users/adrgs/repos)
- [https://avatars.githubusercontent.com/u/11564377?v=4](https://avatars.githubusercontent.com/u/11564377?v=4)
- [https://api.github.com/users/adrgs/events%7B/privacy%7D](https://api.github.com/users/adrgs/events%7B/privacy%7D)

## Related threats

- [Remix React Router CSRF bypass on PUT, PATCH, and DELETE requests](https://junglewise.ai/threats/cve-2026-53663-remix-react-router-csrf-bypass-on-put-patch-and-delete-requests)
- [React Router CSRF in Action and Server Action Request Processing](https://junglewise.ai/threats/cve-2026-22030-react-router-csrf-in-action-and-server-action-request-processing)