CVE-2026-53669: React Router Open Redirect via Backslash in <Link> and useNavigate
Summary
CVE-2026-53669: React Router: Open redirect via backslash in and useNavigate (CVE-2025-68470 bypass). Affects react-router versions >= 6.0.0, < 7.18.0. Fixed in 7.18.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
React Router is a popular library for routing in React applications, enabling developers to create dynamic single-page applications with ease. It provides various navigation components, including <Link> and useNavigate, which facilitate seamless transitions between different views. However, a vulnerability has been identified that allows attackers to exploit certain navigation mechanisms, leading to potential open redirects.
Vulnerability Detail
The vulnerability stems from an incomplete fix to a previous issue (CVE-2025-68470), where attacker-supplied paths could still lead to unexpected external navigations. This occurs when a backslash is included in the navigation path, allowing malicious actors to redirect users to unintended external sites. The implications of this vulnerability can be severe, as it may lead to phishing attacks or the exposure of sensitive user information.
How To Fix
Latest published version: 8.5.0 as of 23 Oct 2026
npm install react-router@8.5.0Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
7.18.0
This is the first release that contains the fix.
npm install react-router@7.18.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, ensure that any paths passed to navigation mechanisms are validated and sanitized to prevent the inclusion of unexpected characters, such as backslashes. For example, you can implement a function to check and clean the paths before using them in <Link> or useNavigate.
Conclusion
In summary, CVE-2026-53669 presents a significant risk to applications using React Router due to the potential for open redirects. It is crucial to update to the latest version of the package to ensure security. Additionally, developers should implement best practices for path validation to protect against this and similar vulnerabilities.
See every vulnerability recorded for react-router →
FAQ
CVE-2026-53669 is a vulnerability in the React Router library that allows for open redirects via backslashes in navigation paths.
You can check if your application is affected by using the Vulert playground at Vulert Scanner, which monitors vulnerabilities based on your package-lock.json.
The risks include phishing attacks and the possibility of redirecting users to malicious sites, which can compromise user data and trust.
Yes, the vulnerability has been patched in version 7.18.0 of the react-router package. Updating to this version will resolve the issue.
If immediate updates are not possible, implement validation and sanitization of navigation paths to mitigate the risk of exploitation.
References
Related vulnerabilities
Recent vulnerabilities recorded for react-router.
