Executive brief
React Router is a popular library used to manage navigation in web applications. A security flaw in its experimental React Server Components (RSC) feature could allow attackers to redirect users to malicious websites or execute unauthorized scripts. This could lead to phishing attacks or the theft of sensitive user information if the application uses these specific unstable features.
Technical details
React Router's RSCErrorHandler component fails to properly validate protocols during redirect operations when using unstable React Server Components (RSC) APIs. This lack of validation allows for redirects from untrusted sources, which can be leveraged for Open Redirect attacks or Cross-Site Scripting (XSS) via malicious URI schemes (e.g., javascript:). The vulnerability is tracked as a follow-up to previous redirect issues. An attacker would typically need to entice a user to interact with a specially crafted link. The issue is resolved in version 7.18.0 by implementing stricter protocol checks.
Affected products
- remix-run React Router >= 7.11.0, < 7.18.0
Timeline
- 2026-06-11: patched: Fix committed to main branch
- 2026-07-27: disclosed: CVE published to NVD
References
- https://github.com/remix-run/react-router/blob/main/CHANGELOG.md
- https://github.com/remix-run/react-router/commit/ce596e823f0d7b883a433af1d5a839a8b9fe0242
- https://github.com/remix-run/react-router/pull/15177
- https://github.com/remix-run/react-router/releases/tag/react-router@7.18.0
- https://github.com/remix-run/react-router/security/advisories/GHSA-h8fp-f39c-q6mh