Update dependency react-router to v7.18.2 [SECURITY] - #1662
Open
renovate[bot] wants to merge 1 commit into
Open
Conversation
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## develop #1662 +/- ##
=========================================
Coverage 97.53% 97.53%
=========================================
Files 56 56
Lines 6290 6290
Branches 695 1019 +324
=========================================
Hits 6135 6135
Misses 155 155 ☔ View full report in Codecov by Harness. 🚀 New features to boost your workflow:
|
renovate
Bot
changed the title
renovate
Bot
force-pushed
the
renovate/npm-react-router-vulnerability
branch
from
July 28, 2026 13:07
fc67844 to
7d5958a
Compare
renovate
Bot
force-pushed
the
renovate/npm-react-router-vulnerability
branch
from
August 7, 2026 22:35
7d5958a to
30366da
Compare
renovate
Bot
changed the title
renovate
Bot
force-pushed
the
renovate/npm-react-router-vulnerability
branch
from
August 9, 2026 13:06
30366da to
6749657
Compare
renovate
Bot
changed the title
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
7.15.1→7.18.2React Router: RSCErrorHandler Missing Protocol Validation (XSS)
CVE-2026-53667 / GHSA-h8fp-f39c-q6mh
More information
Details
This is a follow up to GHSA-8646-j5j9-6r62. React Router was alerted of a code path in the (unstable) RSC error handling path in which redirects from untrusted sources could still result in an XSS vector via attacker-supplied redirect targets
Severity
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:L/A:NReferences
This data is provided by the GitHub Advisory Database (CC-BY 4.0).
React Router: Unauthenticated Denial of Service via Inefficient Route Matching
CVE-2026-55685 / GHSA-chx6-hx7r-mcp5
More information
Details
This is a follow up to GHSA-8x6r-g9mw-2r78 that covers additional reported scenarios in which the manifest endpoint could be accessed via unauthenticated targeted requests that would put heavy load on the server and slow down response times.
Severity
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:NReferences
This data is provided by the GitHub Advisory Database (CC-BY 4.0).
React Router: Arbitrary Constructor Injection via deserializeErrors() in React Router SSR Hydration
CVE-2026-53666 / GHSA-337j-9hxr-rhxg
More information
Details
If application code allows attacker supplied input to overwrite certain aspects of errors caught by the SSR process, then it was possible for attacker to trigger unexpected constructor execution on the client which would trigger outbound network traffic. This is only possible with very specific (and unlikely) application layer code.
Severity
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:NReferences
This data is provided by the GitHub Advisory Database (CC-BY 4.0).
React Router: Open redirect via backslash in and useNavigate (CVE-2025-68470 bypass)
CVE-2026-53669 / GHSA-wrjc-x8rr-h8h6
More information
Details
This is a follow up to CVE-2025-68470. React Router was alerted to certain scenarios in which the fix there was incomplete so there still existed some scenarios where attacker supplied paths passed to navigation mechanisms could result in unexpected external navigations.
Severity
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:L/SI:L/SA:NReferences
This data is provided by the GitHub Advisory Database (CC-BY 4.0).
React Router: RSC Mode CSRF Bypass Allows Action Execution Before 400 Response
GHSA-qwww-vcr4-c8h2
More information
Details
This is a follow up to CVE-2026-22030 to address related CSRF flows in unstable RSC code paths.
Severity
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:N/SC:N/SI:N/SA:NReferences
This data is provided by the GitHub Advisory Database (CC-BY 4.0).
Release Notes
remix-run/react-router (react-router)
v7.18.2: v7.18.2Compare Source
See the changelog for release notes: https://github.com/remix-run/react-router/blob/v7/CHANGELOG.md#v7182
v7.18.1: v7.18.1Compare Source
See the changelog for release notes: https://github.com/remix-run/react-router/blob/v7/CHANGELOG.md#v7181
v7.18.0Compare Source
Patch Changes
ssr: falseandfuture.v8_trailingSlashAwareDataRequests: true. Avoids false positive "SPA Mode" detection when serving prerendered paths (#15173)ServerRouternonce for nonce-aware SSR components when they don't provide their own value so strict CSP pages can load them. (#15170)turbo-streamto serialize and deserialize Framework Mode hydration errors (#15175)v7.17.0Compare Source
Minor Changes
Ship a subset of the official documentation inside the
react-routerpackage (#15121)node_modules/react-router/docs, letting AI coding agents and the React Router agent skills read official docs locallyapi/),community/content, and tutorials (tutorials/)v7.16.0Compare Source
Minor Changes
future.unstable_trailingSlashAwareDataRequestsasfuture.v8_trailingSlashAwareDataRequests(#15098)Patch Changes
Disable manifest path when lazy route dicovery is disabled (#15068)
Fix browser URL creation to use the configured history window instead of the global window. (#15066)
createBrowserURLImplso custom window contexts keep the correct URL origin.Fix
useNavigation()return type to preserve discriminated union across navigation states (#15095)Widen
MetaDescriptorscript:ld+jsontype fromLdJsonObjecttoLdJsonObject | LdJsonObject[]to permit multiple JSON-LD schemas in a single<script type="application/ld+json">tag emitted by<Meta />(#15082)Configuration
📅 Schedule: (UTC)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR was generated by Mend Renovate. View the repository job log.