# CVE-2026-53666: remix-run React Router unsafe reflection in SSR hydration

Source: https://junglewise.ai/threats/cve-2026-53666-remix-run-react-router-unsafe-reflection-in-ssr-hydration  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-27. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-53666 · Severity: medium · CVSS 6.1 · Published 2026-07-27

React Router is a popular JavaScript routing library used in web applications, particularly those using server-side rendering (SSR). An attacker can exploit a deserialization flaw to execute arbitrary constructors on the client side when specific application code patterns are present, potentially triggering unintended network requests. This vulnerability only affects Framework Mode and Data Mode applications performing manual SSR/hydration; Declarative Mode is unaffected.

Technologies: [React-Router](https://junglewise.ai/threats/technologies/npm-react-router).

## Quick answers

**Is CVE-2026-53666 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-53666 being exploited in the wild.

**How severe is CVE-2026-53666?** Medium severity, with a CVSS score of 6.1, published 27 July 2026.

**Which products and versions are affected?** React-Router SEMVER:introduced=6.4.0,fixed=7.18.0.

**Is there a fix for CVE-2026-53666?** Yes. React-Router: upgrade to 7.18.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-53666 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-53666?** Check whether you run React-Router at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- React-Router: upgrade to 7.18.0 or later

## Technical details

The vulnerability exists in React Router's SSR hydration error deserialization mechanism, specifically in the deserializeErrors() function. An attacker who can control application-layer error handling code can inject arbitrary constructor execution during the hydration phase on the client side. This is a deserialization-based code execution issue (CWE-470) that requires specific and unlikely application code patterns to be exploitable. The attack vector is network-based with no privileges required but does require user interaction (UI rendering). The root cause was addressed in version 7.18.0 by switching from custom error serialization to turbo-stream encoding, which prevents constructor injection. Patched versions are available in react-router >= 7.18.0.

## Affected products

- Remix react-router >=6.4.0, <7.18.0

## Identifiers

- CVE-2026-53666
- GHSA-337j-9hxr-rhxg

## Timeline

- 2026-07-23: disclosed
- 2026-07-23: patched: Fix released in react-router 7.18.0

## References

- [https://github.com/remix-run/react-router/security/advisories/GHSA-337j-9hxr-rhxg](https://github.com/remix-run/react-router/security/advisories/GHSA-337j-9hxr-rhxg)
- [https://github.com/remix-run/react-router/pull/15175](https://github.com/remix-run/react-router/pull/15175)
- [https://github.com/remix-run/react-router/commit/9d22943fd46c8ae4b08236425fa3549e10e9ad1a](https://github.com/remix-run/react-router/commit/9d22943fd46c8ae4b08236425fa3549e10e9ad1a)
- [https://github.com/remix-run/react-router](https://github.com/remix-run/react-router)
- [https://github.com/remix-run/react-router/blob/main/CHANGELOG.md](https://github.com/remix-run/react-router/blob/main/CHANGELOG.md)
- [https://github.com/remix-run/react-router/releases/tag/react-router@7.18.0](https://github.com/remix-run/react-router/releases/tag/react-router@7.18.0)

## Related threats

- [remix-run react-router resource consumption in manifest endpoint](https://junglewise.ai/threats/cve-2026-55685-remix-run-react-router-resource-consumption-in-manifest-endpoint)
- [Remix React Router open redirect in Link and useNavigate](https://junglewise.ai/threats/cve-2026-53669-remix-react-router-open-redirect-in-link-and-usenavigate)
- [remix-run React Router improper protocol validation in RSCErrorHandler](https://junglewise.ai/threats/cve-2026-53667-remix-run-react-router-improper-protocol-validation-in)
- [React Router CSRF bypass in RSC mode](https://junglewise.ai/threats/react-router-csrf-bypass-in-rsc-mode-0018662d)
- [React Router remote code execution in Framework Mode](https://junglewise.ai/threats/cve-2026-42211-react-router-remote-code-execution-in-framework-mode)