chore(deps): update dependency react-router to v7.18.0 [security] - #408
Merged
Merged
Conversation
renovate
Bot
force-pushed
the
renovate/npm-react-router-vulnerability
branch
from
August 7, 2026 21:30
5088bd1 to
815eaac
Compare
renovate
Bot
changed the title
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
7.15.1→7.18.0React Router: RSCErrorHandler Missing Protocol Validation (XSS)
CVE-2026-53667 / GHSA-h8fp-f39c-q6mh
More information
Details
This is a follow up to GHSA-8646-j5j9-6r62. React Router was alerted of a code path in the (unstable) RSC error handling path in which redirects from untrusted sources could still result in an XSS vector via attacker-supplied redirect targets
Severity
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:L/A:NReferences
This data is provided by the GitHub Advisory Database (CC-BY 4.0).
React Router: Unauthenticated Denial of Service via Inefficient Route Matching
CVE-2026-55685 / GHSA-chx6-hx7r-mcp5
More information
Details
This is a follow up to GHSA-8x6r-g9mw-2r78 that covers additional reported scenarios in which the manifest endpoint could be accessed via unauthenticated targeted requests that would put heavy load on the server and slow down response times.
Severity
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:NReferences
This data is provided by the GitHub Advisory Database (CC-BY 4.0).
React Router: Arbitrary Constructor Injection via deserializeErrors() in React Router SSR Hydration
CVE-2026-53666 / GHSA-337j-9hxr-rhxg
More information
Details
If application code allows attacker supplied input to overwrite certain aspects of errors caught by the SSR process, then it was possible for attacker to trigger unexpected constructor execution on the client which would trigger outbound network traffic. This is only possible with very specific (and unlikely) application layer code.
Severity
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:NReferences
This data is provided by the GitHub Advisory Database (CC-BY 4.0).
React Router: Open redirect via backslash in and useNavigate (CVE-2025-68470 bypass)
CVE-2026-53669 / GHSA-wrjc-x8rr-h8h6
More information
Details
This is a follow up to CVE-2025-68470. React Router was alerted to certain scenarios in which the fix there was incomplete so there still existed some scenarios where attacker supplied paths passed to navigation mechanisms could result in unexpected external navigations.
Severity
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:L/SI:L/SA:NReferences
This data is provided by the GitHub Advisory Database (CC-BY 4.0).
Release Notes
remix-run/react-router (react-router)
v7.18.0Compare Source
Patch Changes
ssr: falseandfuture.v8_trailingSlashAwareDataRequests: true. Avoids false positive "SPA Mode" detection when serving prerendered paths (#15173)ServerRouternonce for nonce-aware SSR components when they don't provide their own value so strict CSP pages can load them. (#15170)turbo-streamto serialize and deserialize Framework Mode hydration errors (#15175)v7.17.0Compare Source
Minor Changes
Ship a subset of the official documentation inside the
react-routerpackage (#15121)node_modules/react-router/docs, letting AI coding agents and the React Router agent skills read official docs locallyapi/),community/content, and tutorials (tutorials/)v7.16.0Compare Source
Minor Changes
future.unstable_trailingSlashAwareDataRequestsasfuture.v8_trailingSlashAwareDataRequests(#15098)Patch Changes
Disable manifest path when lazy route dicovery is disabled (#15068)
Fix browser URL creation to use the configured history window instead of the global window. (#15066)
createBrowserURLImplso custom window contexts keep the correct URL origin.Fix
useNavigation()return type to preserve discriminated union across navigation states (#15095)Widen
MetaDescriptorscript:ld+jsontype fromLdJsonObjecttoLdJsonObject | LdJsonObject[]to permit multiple JSON-LD schemas in a single<script type="application/ld+json">tag emitted by<Meta />(#15082)Configuration
📅 Schedule: (UTC)
🚦 Automerge: Enabled.
♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR was generated by Mend Renovate. View the repository job log.