Vulnerability details
CVE-2026-55685
remix-run react-router
React Router: Unauthenticated Denial of Service via Inefficient Route Matching
CVSS 4.0
8.7High
Official description
React Router is a router for React. In versions 7.0.0 through 7.17.0, the manifest endpoint could be accessed via unauthenticated targeted requests that would put heavy load on the server and slow down response times. This issue is a follow up to CVE-2026-42342, and does not does not impact React Router applications using Declarative Mode (<BrowserRouter>) or Data Mode (createBrowserRouter/<RouterProvider>). This issue has been fixed in version 7.18.0.
CVSS scores
| Score | Version | Source | Vector |
|---|---|---|---|
| 8.7High | 4.0 | CVEProject cvelistV5 (CNA) (GitHub_M) | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N |
Affected products
| Vendor | Product | Versions | Source |
|---|---|---|---|
| remix-run | react-router | >= 7.0.0, < 7.18.0 | CVEProject cvelistV5 (CNA) |
References and advisories
6- https://github.com/remix-run/react-router/security/advisories/GHSA-chx6-hx7r-mcp5 x_refsource_CONFIRM
- https://github.com/remix-run/react-router/security/advisories/GHSA-8x6r-g9mw-2r78 x_refsource_MISC
- https://github.com/remix-run/react-router/pull/15186 x_refsource_MISC
- https://github.com/remix-run/react-router/commit/09e6020d1950e54f361f7ad00938ecd4dde60929 x_refsource_MISC
- https://github.com/remix-run/react-router/blob/main/CHANGELOG.md#v7180 x_refsource_MISC
- https://github.com/remix-run/react-router/releases/tag/react-router@7.18.0 x_refsource_MISC
Kolun on Telegram @kolunsec
Exploited CVEs, key news and a daily digest
Alerts for this product's next CVEsFollow the product to get new vulnerabilities on Telegram.
Details
- Published
- 2026-07-28
- Last updated
- 2026-07-28
- State
- Published
- Assigner (CNA)
- GitHub_M
Exploit prediction (EPSS)
0.7%
Probability of exploitation in 30 days
53.6%
Percentile (among all CVEs)
SSVC assessment (CISA)
- Automatable
- Yes
- Exploitation
- None
- Technical impact
- Partial
Weaknesses (CWE)
- CWE-400Uncontrolled Resource Consumption
- CWE-407Inefficient Algorithmic Complexity