CVE-2026-40181

Name of the Vulnerable Software and Affected Versions React Router versions 6.7.0 through 6.30.3 React Router versions 7.0.0 through 7.14.0

Description Certain URLs passed to the redirect() function can trigger an open redirect to an external domain. This occurs because path values starting with // are reinterpreted as protocol-relative URLs, which are URLs that inherit the protocol (HTTP or HTTPS) of the current page. The impact depends on the validation performed by the application before the redirect is returned. This issue does not affect applications using Declarative Mode (<BrowserRouter>).

Recommendations Update to version 6.30.4 for versions 6.7.0 through 6.30.3. Update to version 7.14.1 for versions 7.0.0 through 7.14.0.