React Router: Unauthenticated Denial of Service via Inefficient Route Matching

高 7.5CVE-2026-55685 · GHSA-chx6-hx7r-mcp5 · 27/07/2026 公開 · 24/10/2026 更新

要点

CVE-2026-55685 は react-router (shopify), react-router に影響する深刻度「高」 (CVSS 7.5) の脆弱性です。
今後30日間に悪用される確率（EPSS）：0.71%（全脆弱性の 53.5% より高い）。
対処：7.18.0 以降に更新してください。

パッケージ	影響を受けるバージョン	修正済みバージョン
react-router shopify	`≥ 7.0.0, < 7.18.0`	`7.18.0`
react-router npm	`≥ 7.0.0, < 7.18.0`	`7.18.0`

概要

This is a follow up to https://github.com/remix-run/react-router/security/advisories/GHSA-8x6r-g9mw-2r78 that covers additional reported scenarios in which the manifest endpoint could be accessed via unauthenticated targeted requests that would put heavy load on the server and slow down response times.

[!NOTE] This only impacts Framework Mode applications. This does not impact your application if you are using Declarative or Data Mode.

NVD の説明

React Router is a router for React. In versions 7.0.0 through 7.17.0, the manifest endpoint could be accessed via unauthenticated targeted requests that would put heavy load on the server and slow down response times. This issue is a follow up to CVE-2026-42342, and does not does not impact React Router applications using Declarative Mode (<BrowserRouter>) or Data Mode (createBrowserRouter/<RouterProvider>). This issue has been fixed in version 7.18.0.