CVE-2026-53667

Name of the Vulnerable Software and Affected Versions React Router versions 7.11.0 through 7.17.0

Description The RSCErrorHandler lacks protocol validation, which allows redirects from untrusted sources. This can lead to a Cross-Site Scripting (XSS) vector—a technique where malicious scripts are injected into trusted websites—via attacker-supplied redirect targets. This issue only affects applications utilizing the unstable RSC (React Server Components) APIs.

Recommendations Update React Router to version 7.18.0. Restrict the use of unstable RSC APIs as a temporary mitigation measure.