React Router: Unauthenticated Denial of Service via Inefficient Route Matching

CAO 7.5CVE-2026-55685 · GHSA-chx6-hx7r-mcp5 · Công bố 27/07/2026 · cập nhật 24/10/2026

Tóm tắt nhanh

CVE-2026-55685 là lỗ hổng mức CAO (CVSS 7.5) ảnh hưởng react-router (shopify), react-router.
Xác suất bị khai thác trong 30 ngày tới (EPSS): 0.71%, cao hơn 53.5% các lỗ hổng khác.
Cách xử lý: cập nhật lên 7.18.0 hoặc mới hơn.

Gói / sản phẩm	Phiên bản bị ảnh hưởng	Phiên bản đã vá
react-router shopify	`≥ 7.0.0, < 7.18.0`	`7.18.0`
react-router npm	`≥ 7.0.0, < 7.18.0`	`7.18.0`

Mô tả

This is a follow up to https://github.com/remix-run/react-router/security/advisories/GHSA-8x6r-g9mw-2r78 that covers additional reported scenarios in which the manifest endpoint could be accessed via unauthenticated targeted requests that would put heavy load on the server and slow down response times.

[!NOTE] This only impacts Framework Mode applications. This does not impact your application if you are using Declarative or Data Mode.

Mô tả của NVD

React Router is a router for React. In versions 7.0.0 through 7.17.0, the manifest endpoint could be accessed via unauthenticated targeted requests that would put heavy load on the server and slow down response times. This issue is a follow up to CVE-2026-42342, and does not does not impact React Router applications using Declarative Mode (<BrowserRouter>) or Data Mode (createBrowserRouter/<RouterProvider>). This issue has been fixed in version 7.18.0.