In short
- CVE-2026-42342 is a HIGH (CVSS 7.5) vulnerability affecting react-router (shopify), remix-run/server-runtime (shopify), @remix-run/server-runtime.
- Chance of exploitation in the next 30 days (EPSS): 0.30%, higher than 22.7% of all vulnerabilities.
- Fix: update to 7.15.0, 2.17.5 or later.
Description
There exists a potential DOS attack vector in React Router Framework Mode applications (as well as Remix v2.10.0 - 2.17.4). Certain requests can be crafted to consume disproportionate resources on the server, resulting in response time degredation and/or service unavailability for end users.
[!NOTE]
This does not impact your React Router application if you are using Declarative Mode (<BrowserRouter>) or Data Mode (createBrowserRouter/<RouterProvider>).
NVD description
React Router is a router for React. In versions 7.0.0 through 7.14.x of react-router and versions 2.10.0 through 2.17.4 of @remix-run/server-runtime, certain crafted requests can consume disproportionate server resources via unbounded path expansion in the __manifest endpoint, resulting in response time degradation and/or service unavailability for end users. This affects React Router Framework Mode applications as well as Remix applications. This does not impact applications using Declarative Mode (`<BrowserRouter>`) or Data Mode (`createBrowserRouter/<RouterProvider>`). This is patched in react-router version 7.15.0 and @remix-run/server-runtime version 2.17.5.
More vulnerabilities in react-router
See all →Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free