| Package | Affected versions | Patched versions |
|---|---|---|
| react-router | ≥ 7.0.0, < 7.15.0 | 7.15.0 |
| remix-run/server-runtime | ≥ 2.10.0, < 2.17.5 | 2.17.5 |
| @remix-run/server-runtime | ≥ 2.10.0, < 2.17.5 | 2.17.5 |
| react-router | ≥ 7.0.0, < 7.15.0 | 7.15.0 |
There exists a potential DOS attack vector in React Router Framework Mode applications (as well as Remix v2.10.0 - 2.17.4). Certain requests can be crafted to consume disproportionate resources on the server, resulting in response time degredation and/or service unavailability for end users.
[!NOTE] This does not impact your React Router application if you are using Declarative Mode (
<BrowserRouter>) or Data Mode (createBrowserRouter/<RouterProvider>).
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free