In short
- CVE-2026-42211 is a HIGH (CVSS 8.1) vulnerability affecting react-router (shopify), react-router.
- Chance of exploitation in the next 30 days (EPSS): 0.42%, higher than 35.9% of all vulnerabilities.
- Fix: update to 7.14.2 or later.
Description
When using React Router v7 in Framework Mode, there exists a combination of steps that could potentially allow unauthorized RCE through external requests. This first requires the application code to have an existing prototype pollution vulnerability. This can be leveraged into a 2-step attack in which the second step can trigger unauthorized RCE on the remote server.
[!NOTE]
This does not impact your React Router application if you are using Declarative Mode (<BrowserRouter>) or Data Mode (createBrowserRouter/<RouterProvider>).
NVD description
React Router is a router for React. In versions 7.0.0 through 7.14.1, when using Framework Mode, a combination of steps could potentially allow unauthorized remote code execution (RCE) through external requests. This attack requires the application code to have an existing prototype pollution vulnerability, which can then be leveraged in a 2-step attack where the second step triggers unauthorized RCE on the remote server. This does not impact applications using Declarative Mode (`<BrowserRouter>`) or Data Mode (`createBrowserRouter/<RouterProvider>`). This is patched in version 7.14.2.
More vulnerabilities in react-router
See all →Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free