CVE-2026-42211: React Router Arbitrary Constructor Invocation via TYPE_ERROR Deserialization
Summary
CVE-2026-42211: When using React Router v7 in Framework Mode, there exists a combination of steps that could potentially allow unauthorized RCE through external requests. Affects react-router versions >= 7.0.0, < 7.14.2. Fixed in 7.14.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
React Router is a popular routing library for React applications, enabling developers to create dynamic single-page applications with ease. It supports various modes of operation, including Framework Mode, which allows for server-side rendering and enhanced performance. However, a vulnerability has been identified in the vendored turbo-stream v2 when used in Framework Mode, exposing applications to potential security risks.
Vulnerability Detail
The vulnerability arises from a combination of using React Router v7 in Framework Mode and the presence of an existing prototype pollution vulnerability in the application code. This can lead to a two-step attack where unauthorized remote code execution (RCE) can be triggered through external requests. The severity of this vulnerability is high, with a CVSS score of 8.1, indicating significant potential for exploitation if not addressed.
How To Fix
Latest published version: 8.5.0 as of 23 Oct 2026
npm install react-router@8.5.0Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
7.14.2
This is the first release that contains the fix.
npm install react-router@7.14.2Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate updating is not feasible, consider switching to Declarative Mode or Data Mode in your application, as these modes are not impacted by this vulnerability. For example, you can use <BrowserRouter> for Declarative Mode or createBrowserRouter for Data Mode.
Conclusion
CVE-2026-42211 poses a significant risk to applications using React Router in Framework Mode due to the potential for unauthorized remote code execution. It is crucial for developers to update to the patched version or implement workarounds to mitigate this vulnerability.
See every vulnerability recorded for react-router →
FAQ
CVE-2026-42211 is a vulnerability in React Router that allows for arbitrary constructor invocation through TYPE_ERROR deserialization, potentially leading to unauthorized remote code execution.
You can use Vulert, which monitors open-source vulnerabilities in your software. By uploading your package-lock.json file, you can receive real-time alerts about vulnerabilities, including CVE-2026-42211.
As a temporary measure, switch to Declarative Mode or Data Mode, which are not affected by this vulnerability.
The vulnerability has a CVSS score of 8.1, indicating a high severity level and significant risk of exploitation.
You can find detailed information about CVE-2026-42211 in the official advisory on GitHub and other security databases.
References
Related vulnerabilities
Recent vulnerabilities recorded for react-router.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
