CVE-2026-53666

Name of the Vulnerable Software and Affected Versions React Router versions 6.4.0 through 7.17.0

Description In Framework Mode and Data Mode applications performing manual SSR (Server-Side Rendering), a flaw exists where attacker-supplied input can overwrite specific aspects of errors caught during the SSR process. This can lead to unexpected constructor execution on the client side, resulting in unauthorized outbound network requests. This issue requires very specific application-layer code to be exploitable and does not affect applications using Declarative Mode.

Recommendations Update to version 7.18.0.