CVE-2026-34077: remix-run react-router
Vulnerability summary
CVE-2026-34077 is a high (CVSS 7.5) vulnerability in remix-run react-router. EPSS estimates a 0.45% chance of exploitation in the next 30 days, higher than 38% of scored vulnerabilities.
Timeline
- 02-06-2026PublishedVulnerability first disclosed.
- 03-06-2026Last modifiedVulnerability information updated.
Description
React Router is a router for React. In versions 7.7.0 through 7.13.1, when using React Router's unstable React Server Components (RSC) APIs, there is a potential client-side Cross-Site Scripting (XSS) vulnerability in the RSC redirect handling if redirects come from untrusted sources. This does not impact applications that are not using the unstable RSC APIs in React Router. This is patched in version 7.13.2.
CVSS metrics
4 scores · 4 sources · 1 version- OSV · NpmEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- OSV · ChainguardEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- NVDNIST7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS trend
Probability
0.45%
Chance of exploitation in the next 30 days
Percentile
38%
Versus all other CVEs
30-day change
+0.16 pp
From 0.29% on 20-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Chainguard2 products
- airflow-2All versions (No fix recorded)
- airflow-core-2All versions (No fix recorded)
Npm2 products
- react-router≥ 7.0.0, < 7.14.0
- turbo-stream< 3.0.0
Remix-run2 products
- react-router≥ 7.0.0, < 7.14.0
- turbo-stream< 3.0.0
Opensuse1 product
- agama-web-ui&distro=openSUSE Tumbleweed< 22+143.ee15dea20-46.1
Shopify1 product
- react-router≥ 7.0.0, < 7.14.0
Turbo-stream1 product
- turbo_stream< 3.0.0
6 vendors · 9 products
References
8 links- github.com/remix-run/react-router/security/advisories/GHSA-rxv8-25v2-qmq8X Refsource CONFIRMWEBAdvisoryVendor Advisory
