CVE-2026-55685: React Router Unauthenticated Denial of Service via Inefficient Route Matching
Summary
CVE-2026-55685: React Router: Unauthenticated Denial of Service via Inefficient Route Matching. Affects react-router versions >= 7.0.0, < 7.18.0. Fixed in 7.18.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
React Router is a popular library for routing in React applications, allowing developers to create dynamic single-page applications with ease. It provides a powerful and flexible API for managing navigation and rendering components based on the current URL. However, certain configurations, particularly in Framework Mode, can expose applications to vulnerabilities that may lead to performance degradation under specific attack scenarios.
Vulnerability Detail
The vulnerability arises from inefficient route matching in React Router, which can be exploited by unauthenticated users sending targeted requests to the manifest endpoint. This can lead to a Denial of Service (DoS) condition, where the server experiences heavy load, resulting in slow response times or even crashes. The issue is particularly relevant for applications using Framework Mode, as it allows attackers to exploit the routing mechanism without needing authentication.
How To Fix
Latest published version: 8.5.0 as of 23 Oct 2026
npm install react-router@8.5.0Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
7.18.0
This is the first release that contains the fix.
npm install react-router@7.18.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, consider implementing rate limiting on your server to mitigate the impact of potential attacks targeting the manifest endpoint. This can help reduce the load caused by repeated requests from unauthenticated users.
Conclusion
In summary, CVE-2026-55685 is a significant vulnerability in React Router that can lead to unauthenticated denial of service through inefficient route matching. It is crucial for developers using affected versions to update to the latest patched version to protect their applications from potential attacks.
See every vulnerability recorded for react-router →
FAQ
The CVSS score of this vulnerability is 8.7, indicating a high severity level.
Versions of React Router from 7.0.0 to 7.17.9 are affected by this vulnerability.
No, this vulnerability only impacts applications using Framework Mode.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If immediate updating is not possible, implement rate limiting on your server as a temporary measure to mitigate the risk of denial of service attacks.
References
Related vulnerabilities
Recent vulnerabilities recorded for react-router.
