Is CVE-2026-53667 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-53667 being exploited in the wild.

How severe is CVE-2026-53667?

Medium severity, with a CVSS score of 6.9, published 27 July 2026.

Which products and versions are affected?

React-Router SEMVER:introduced=7.11.0,fixed=7.18.0.

Is there a fix for CVE-2026-53667?

Yes. React-Router: upgrade to 7.18.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-53667 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-53667?

Check whether you run React-Router at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-53667: remix-run React Router improper protocol validation in RSCErrorHandler

CVE-2026-53667 · Severity: medium · CVSS 6.9 · Published 2026-07-27

React Router is a popular library used to manage navigation in web applications. A security flaw in its experimental React Server Components (RSC) feature could allow attackers to redirect users to malicious websites or execute unauthorized scripts. This could lead to phishing attacks or the theft of sensitive user information if the application uses these specific unstable features.

Technologies: React-Router.

Quick answers

Is CVE-2026-53667 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-53667 being exploited in the wild.
How severe is CVE-2026-53667?: Medium severity, with a CVSS score of 6.9, published 27 July 2026.
Which products and versions are affected?: React-Router SEMVER:introduced=7.11.0,fixed=7.18.0.
Is there a fix for CVE-2026-53667?: Yes. React-Router: upgrade to 7.18.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-53667 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-53667?: Check whether you run React-Router at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

React-Router: upgrade to 7.18.0 or later

Technical details

React Router's RSCErrorHandler component fails to properly validate protocols during redirect operations when using unstable React Server Components (RSC) APIs. This lack of validation allows for redirects from untrusted sources, which can be leveraged for Open Redirect attacks or Cross-Site Scripting (XSS) via malicious URI schemes (e.g., javascript:). The vulnerability is tracked as a follow-up to previous redirect issues. An attacker would typically need to entice a user to interact with a specially crafted link. The issue is resolved in version 7.18.0 by implementing stricter protocol checks.

Affected products

remix-run React Router >= 7.11.0, < 7.18.0

Identifiers

CVE-2026-53667
GHSA-h8fp-f39c-q6mh

Timeline

2026-06-11: patched: Fix committed to main branch
2026-07-27: disclosed: CVE published to NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.