# CVE-2026-55685: remix-run react-router resource consumption in manifest endpoint

Source: https://junglewise.ai/threats/cve-2026-55685-remix-run-react-router-resource-consumption-in-manifest-endpoint  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-27. Updated: 2026-07-27  
License: CC BY 4.0 with a link back

CVE-2026-55685 · Severity: high · CVSS 4 · Published 2026-07-27

React Router, a popular library for managing navigation in React web applications, contains a vulnerability in its manifest endpoint. An unauthenticated attacker can send specially crafted requests to this endpoint to consume excessive server resources. This can lead to significant performance degradation or a complete service outage for legitimate users.

Technologies: [React-Router](https://junglewise.ai/threats/technologies/npm-react-router).

## Quick answers

**Is CVE-2026-55685 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-55685 being exploited in the wild.

**How severe is CVE-2026-55685?** High severity, with a CVSS score of 4, published 27 July 2026.

**Which products and versions are affected?** React-Router SEMVER:introduced=7.0.0,fixed=7.18.0.

**Is there a fix for CVE-2026-55685?** Yes. React-Router: upgrade to 7.18.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-55685 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-55685?** Check whether you run React-Router at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- React-Router: upgrade to 7.18.0 or later

## Technical details

A vulnerability classified as uncontrolled resource consumption (CWE-400) and inefficient algorithmic complexity (CWE-407) exists in React Router's manifest endpoint. In affected versions (7.0.0 to 7.17.0), the endpoint can be accessed via unauthenticated network requests that trigger expensive route-matching operations. This allows a remote attacker to perform a Denial of Service (DoS) attack by saturating server CPU/memory. The issue specifically affects applications not using Declarative Mode (<BrowserRouter>) or Data Mode (createBrowserRouter). A fix was introduced in version 7.18.0 by optimizing route matching internals and manifest discovery.

## Affected products

- remix-run react-router >= 7.0.0, < 7.18.0

## Identifiers

- CVE-2026-55685
- GHSA-chx6-hx7r-mcp5

## Timeline

- 2026-06-15: patched: Fix committed to main branch
- 2026-07-27: advisory: CVE published to NVD

## References

- [https://github.com/remix-run/react-router/blob/main/CHANGELOG.md](https://github.com/remix-run/react-router/blob/main/CHANGELOG.md)
- [https://github.com/remix-run/react-router/commit/09e6020d1950e54f361f7ad00938ecd4dde60929](https://github.com/remix-run/react-router/commit/09e6020d1950e54f361f7ad00938ecd4dde60929)
- [https://github.com/remix-run/react-router/pull/15186](https://github.com/remix-run/react-router/pull/15186)
- [https://github.com/remix-run/react-router/releases/tag/react-router@7.18.0](https://github.com/remix-run/react-router/releases/tag/react-router@7.18.0)
- [https://github.com/remix-run/react-router/security/advisories/GHSA-8x6r-g9mw-2r78](https://github.com/remix-run/react-router/security/advisories/GHSA-8x6r-g9mw-2r78)
- [https://github.com/remix-run/react-router/security/advisories/GHSA-chx6-hx7r-mcp5](https://github.com/remix-run/react-router/security/advisories/GHSA-chx6-hx7r-mcp5)

## Related threats

- [Remix React Router open redirect in Link and useNavigate](https://junglewise.ai/threats/cve-2026-53669-remix-react-router-open-redirect-in-link-and-usenavigate)
- [remix-run React Router improper protocol validation in RSCErrorHandler](https://junglewise.ai/threats/cve-2026-53667-remix-run-react-router-improper-protocol-validation-in)
- [remix-run React Router unsafe reflection in SSR hydration](https://junglewise.ai/threats/cve-2026-53666-remix-run-react-router-unsafe-reflection-in-ssr-hydration)
- [React Router CSRF bypass in RSC mode](https://junglewise.ai/threats/react-router-csrf-bypass-in-rsc-mode-0018662d)
- [React Router remote code execution in Framework Mode](https://junglewise.ai/threats/cve-2026-42211-react-router-remote-code-execution-in-framework-mode)