Vulnerability Description
React Router is a router for React. In versions 7.0.0 through 7.17.0, the manifest endpoint could be accessed via unauthenticated targeted requests that would put heavy load on the server and slow down response times. This issue is a follow up to CVE-2026-42342, and does not does not impact React Router applications using Declarative Mode (<BrowserRouter>) or Data Mode (createBrowserRouter/<RouterProvider>). This issue has been fixed in version 7.18.0.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Shopify | React-Router | >= 7.0.0, < 7.18.0 |
Related Weaknesses (CWE)
References
- https://github.com/remix-run/react-router/blob/main/CHANGELOG.md#v7180Release Notes
- https://github.com/remix-run/react-router/commit/09e6020d1950e54f361f7ad00938ecdPatch
- https://github.com/remix-run/react-router/pull/15186Issue TrackingPatch
- https://github.com/remix-run/react-router/releases/tag/[email protected]Release Notes
- https://github.com/remix-run/react-router/security/advisories/GHSA-8x6r-g9mw-2r7Third Party Advisory
- https://github.com/remix-run/react-router/security/advisories/GHSA-chx6-hx7r-mcpThird Party Advisory
FAQ
What is CVE-2026-55685?
CVE-2026-55685 is a vulnerability with a CVSS score of 7.5 (HIGH). React Router is a router for React. In versions 7.0.0 through 7.17.0, the manifest endpoint could be accessed via unauthenticated targeted requests that would put heavy load on the server and slow dow...
How severe is CVE-2026-55685?
CVE-2026-55685 has been rated HIGH with a CVSS base score of 7.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-55685?
Check the references section above for vendor advisories and patch information. Affected products include: Shopify React-Router.