Vulnerable Library - react-router-dom-6.30.3.tgz
Path to dependency file: /client/package.json
Path to vulnerable library: /client/package.json
Vulnerabilities
| Vulnerability |
Severity |
 CVSS |
Dependency |
Type |
Fixed in (react-router-dom version) |
Remediation Possible** |
| CVE-2026-40181 |
 High |
7.5 |
react-router-6.30.3.tgz |
Transitive |
7.0.0 |
❌ |
**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation
Details
CVE-2026-40181
Vulnerable Library - react-router-6.30.3.tgz
Declarative routing for React
Library home page: https://registry.npmjs.org/react-router/-/react-router-6.30.3.tgz
Path to dependency file: /client/package.json
Path to vulnerable library: /client/package.json
Dependency Hierarchy:
- react-router-dom-6.30.3.tgz (Root Library)
- ❌ react-router-6.30.3.tgz (Vulnerable Library)
Found in base branch: main
Vulnerability Details
React Router is a router for React. In versions 7.0.0 through 7.14.0 and 6.7.0 through 6.30.3, certain URLs passed to the redirect function can trigger an open redirect to an external domain due to path values starting with // being reinterpreted as protocol-relative URLs. The level of impact depends on the validation done by the application prior to returning the redirect. This does not impact applications using Declarative Mode (). This is patched in versions 7.14.1 and 6.30.4.
Publish Date: 2026-06-02
URL: CVE-2026-40181
CVSS 3 Score Details (7.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: High
- Availability Impact: None
For more information on CVSS3 Scores, click here.
Suggested Fix
Type: Upgrade version
Release Date: 2026-06-02
Fix Resolution (react-router): 6.30.4
Direct dependency fix Resolution (react-router-dom): 7.0.0
Step up your Open Source Security Game with Mend here
Path to dependency file: /client/package.json
Path to vulnerable library: /client/package.json
Vulnerabilities
**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation
Details
Vulnerable Library - react-router-6.30.3.tgz
Declarative routing for React
Library home page: https://registry.npmjs.org/react-router/-/react-router-6.30.3.tgz
Path to dependency file: /client/package.json
Path to vulnerable library: /client/package.json
Dependency Hierarchy:
Found in base branch: main
Vulnerability Details
React Router is a router for React. In versions 7.0.0 through 7.14.0 and 6.7.0 through 6.30.3, certain URLs passed to the redirect function can trigger an open redirect to an external domain due to path values starting with // being reinterpreted as protocol-relative URLs. The level of impact depends on the validation done by the application prior to returning the redirect. This does not impact applications using Declarative Mode (). This is patched in versions 7.14.1 and 6.30.4.
Publish Date: 2026-06-02
URL: CVE-2026-40181
CVSS 3 Score Details (7.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: High
- Availability Impact: None
For more information on CVSS3 Scores, click here.Suggested Fix
Type: Upgrade version
Release Date: 2026-06-02
Fix Resolution (react-router): 6.30.4
Direct dependency fix Resolution (react-router-dom): 7.0.0
Step up your Open Source Security Game with Mend here