Is CVE-2026-53666 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-53666 being exploited in the wild.

How severe is CVE-2026-53666?

Medium severity, with a CVSS score of 6.1, published 27 July 2026.

Which products and versions are affected?

React-Router SEMVER:introduced=6.4.0,fixed=7.18.0.

Is there a fix for CVE-2026-53666?

Yes. React-Router: upgrade to 7.18.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-53666 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-53666?

Check whether you run React-Router at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-53666: remix-run React Router unsafe reflection in SSR hydration

CVE-2026-53666 · Severity: medium · CVSS 6.1 · Published 2026-07-27

React Router is a popular JavaScript routing library used in web applications, particularly those using server-side rendering (SSR). An attacker can exploit a deserialization flaw to execute arbitrary constructors on the client side when specific application code patterns are present, potentially triggering unintended network requests. This vulnerability only affects Framework Mode and Data Mode applications performing manual SSR/hydration; Declarative Mode is unaffected.

Technologies: React-Router.

Quick answers

Is CVE-2026-53666 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-53666 being exploited in the wild.
How severe is CVE-2026-53666?: Medium severity, with a CVSS score of 6.1, published 27 July 2026.
Which products and versions are affected?: React-Router SEMVER:introduced=6.4.0,fixed=7.18.0.
Is there a fix for CVE-2026-53666?: Yes. React-Router: upgrade to 7.18.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-53666 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-53666?: Check whether you run React-Router at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

React-Router: upgrade to 7.18.0 or later

Technical details

The vulnerability exists in React Router's SSR hydration error deserialization mechanism, specifically in the deserializeErrors() function. An attacker who can control application-layer error handling code can inject arbitrary constructor execution during the hydration phase on the client side. This is a deserialization-based code execution issue (CWE-470) that requires specific and unlikely application code patterns to be exploitable. The attack vector is network-based with no privileges required but does require user interaction (UI rendering). The root cause was addressed in version 7.18.0 by switching from custom error serialization to turbo-stream encoding, which prevents constructor injection. Patched versions are available in react-router >= 7.18.0.

Affected products

Remix react-router >=6.4.0, <7.18.0

Identifiers

CVE-2026-53666
GHSA-337j-9hxr-rhxg

Timeline

2026-07-23: disclosed
2026-07-23: patched: Fix released in react-router 7.18.0

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.