CVE-2026-55685: remix-run react-router Uncontrolled Resource Consumption
Vulnerability summary
CVE-2026-55685 is a high (CVSS 8.7) Uncontrolled Resource Consumption vulnerability in remix-run react-router. EPSS estimates a 0.71% chance of exploitation in the next 30 days, higher than 52.6% of scored vulnerabilities.
Advisory lineage
Upstream 0 · Downstream 0 · Related 2Timeline
- 27-07-2026PublishedVulnerability first disclosed.
- 28-07-2026Last modifiedVulnerability information updated.
Description
React Router is a router for React. In versions 7.0.0 through 7.17.0, the manifest endpoint could be accessed via unauthenticated targeted requests that would put heavy load on the server and slow down response times. This issue is a follow up to CVE-2026-42342, and does not does not impact React Router applications using Declarative Mode (<BrowserRouter>) or Data Mode (createBrowserRouter/<RouterProvider>). This issue has been fixed in version 7.18.0.
CVSS metrics
6 scores · 5 sources · 2 versions- OSV · WolfiEcosystem advisory · calculated8.7HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
- OSV · NpmEcosystem advisory · calculated8.7HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
- OSV · ChainguardEcosystem advisory · calculated8.7HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
- NVDNIST8.7HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
EPSS trend
Probability
0.71%
Chance of exploitation in the next 30 days
Percentile
53%
Versus all other CVEs
30-day change
+0.31 pp
From 0.40% on 20-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-400Uncontrolled Resource ConsumptionThe product does not properly control the allocation and maintenance of a limited resource.
- CWE-407Inefficient Algorithmic ComplexityAn algorithm in a product has an inefficient worst-case computational complexity that may be detrimental to system performance and can be triggered by an attacker, typically using crafted manipulations that ensure that the worst case is being reached.
Affected systems
Chainguard4 products
- airflow-2All versions (No fix recorded)
- airflow-core-2All versions (No fix recorded)
- vitess-24< 24.0.2-r7
- vitess-24-compat< 24.0.3-r7
Wolfi2 products
- vitess-24< 24.0.2-r7
- vitess-24-compat< 24.0.3-r7
Npm1 product
- react-router≥ 7.0.0, < 7.18.0
Remix-run1 product
- react-router≥ 7.0.0, < 7.18.0
Shopify1 product
- react-router≥ 7.0.0, < 7.18.0
5 vendors · 9 products
References
9 links- github.com/remix-run/react-router/security/advisories/GHSA-chx6-hx7r-mcp5X Refsource CONFIRMAdvisoryWEBThird Party Advisory
- github.com/remix-run/react-router/security/advisories/GHSA-8x6r-g9mw-2r78X Refsource MISCAdvisoryThird Party Advisory
- github.com/remix-run/react-router/commit/09e6020d1950e54f361f7ad00938ecd4dde60929X Refsource MISCFIXWEBPatch
