Vulnerability Description
React Router is a router for React. In versions 6.4.0 through 7.17.0, if application code was written in a way that allows attacker-supplied input to overwrite certain aspects of errors caught by the SSR process, then it was possible for an attacker to trigger unexpected constructor execution on the client, which would in turn trigger an outbound network request. This is only possible with very specific (and unlikely) application-layer code. Note that this does not impact an application if it is using Declarative Mode. It only impacts Framework Mode and Data Mode applications that perform manual SSR/hydration. This issue has been fixed in version 7.18.0.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Shopify | React-Router | >= 6.4.0, < 7.18.0 |
Related Weaknesses (CWE)
References
- https://github.com/remix-run/react-router/blob/main/CHANGELOG.md#v7180Release Notes
- https://github.com/remix-run/react-router/commit/9d22943fd46c8ae4b08236425fa3549Patch
- https://github.com/remix-run/react-router/pull/15175Issue TrackingPatch
- https://github.com/remix-run/react-router/releases/tag/[email protected]Release Notes
- https://github.com/remix-run/react-router/security/advisories/GHSA-337j-9hxr-rhxThird Party Advisory
FAQ
What is CVE-2026-53666?
CVE-2026-53666 is a vulnerability with a CVSS score of 6.1 (MEDIUM). React Router is a router for React. In versions 6.4.0 through 7.17.0, if application code was written in a way that allows attacker-supplied input to overwrite certain aspects of errors caught by the ...
How severe is CVE-2026-53666?
CVE-2026-53666 has been rated MEDIUM with a CVSS base score of 6.1/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-53666?
Check the references section above for vendor advisories and patch information. Affected products include: Shopify React-Router.