VulertSecurity VulertSecurity

Vulnerability Database · npm · Package report

react-router: vulnerability history, versions and safety

react-router is a package in the npm ecosystem. Vulert records 19 vulnerabilities for it across 36 releases, from Apr 2025 to Jul 2026. Each vulnerability names the versions it affects, the fixed version to move to, and a workaround where no fix has been published.

i
19 vulnerabilities recorded H11 M7 L1
i
0 with no fix published

Every vulnerability has a patched version to move to.

i
17 in the last 12 months

Most recent disclosure 24 Jul 2026.

See the disclosure history →
i
0 malicious-package vulnerabilities

No published version shipped hostile code.

See all react-router vulnerabilities

Vulert verdict on react-router 8.5.0 i

Updated on 23 Oct 2026

Good news: 8.5.0, the version you would install today, has no known vulnerabilities. Older releases do — the table below lists all 19.

Package health score 66/100
  • Security Unfixed issues
  • Maintenance Sustainable
  • Popularity Key ecosystem project
  • Community Moderate

What to do: Stay on 8.5.0 or newer. This can change: a vulnerability disclosed tomorrow can affect 8.5.0 too — Vulert watches the package and alerts you if that happens. Monitor it with Vulert →

  • Current release 8.5.0 — unaffected i
  • Vulnerabilities on record 19 over 1 year · 17 in the last year i
  • Latest disclosure 24 Jul 2026 i
  • Highest CVSS 8.7 i
  • With no published fix 0 i
  • Depended on by 348 packages i
  • Stars 56,611 i
  • OpenSSF scorecard 4/10 i
  • Last release this month i
  • Licence MIT i

Version list, release dates, licence and dependants published by the npm registry, refreshed 23 Oct 2026. Licence information is not legal advice.

Concerned about your application's security?

Vulert continues monitoring your dependencies and alerts you when new vulnerabilities are disclosed. No installation and no source-code access required.

01 Versions

Which versions are affected

Every version Vulert tracks for react-router, newest first, with the vulnerabilities recorded against each one. A version showing none has no vulnerability in the Vulert database — open it for the full picture on that release.

i
Version Released Vulert vulnerabilities Licence Fix published Details
8.5.0 19 Oct 2026 none MIT — Details →
0.0.0-experimental-f1bb8ea3f 14 Oct 2026 none MIT — Details →
8.4.0 15 Sep 2026 none MIT — Details →
0.0.0-experimental-f20bcf6de 15 Sep 2026 none MIT — Details →
7.18.4 15 Sep 2026 H1 MIT Yes Details →
0.0.0-experimental-7aea711dd 02 Sep 2026 none MIT — Details →
8.3.1 28 Aug 2026 none MIT — Details →
7.18.3 28 Aug 2026 H1 MIT Yes Details →
0.0.0-experimental-917e6fdc0 27 Aug 2026 none MIT — Details →
6.30.6 18 Aug 2026 M2 MIT Yes Details →
6.30.5 18 Aug 2026 M2 MIT Yes Details →
0.0.0-experimental-320d16107 07 Aug 2026 none MIT — Details →
0.0.0-experimental-2a01b6fd8 07 Aug 2026 none MIT — Details →
0.0.0-experimental-479e73b7b 05 Aug 2026 none MIT — Details →
7.18.2 28 Jul 2026 H1 MIT Yes Details →
8.3.0 22 Jul 2026 none MIT — Details →
8.2.0 08 Jul 2026 H1 MIT Yes Details →
8.1.0 29 Jun 2026 H1 MIT Yes Details →
7.18.1 29 Jun 2026 H1 MIT Yes Details →
0.0.0-experimental-abd9fc79b 22 Jun 2026 none MIT — Details →
8.0.1 18 Jun 2026 H1 MIT Yes Details →
8.0.0 17 Jun 2026 H1 MIT Yes Details →
8.0.0-pre.1 16 Jun 2026 H1 MIT Yes Details →
7.18.0 16 Jun 2026 H1 MIT Yes Details →
0.0.0-experimental-d07149147 15 Jun 2026 none MIT — Details →
7.17.0 04 Jun 2026 H2 M3 MIT Yes Details →
0.0.0-experimental-dd63c14ca 04 Jun 2026 none MIT — Details →
0.0.0-experimental-63fd291ad 04 Jun 2026 none MIT — Details →
8.0.0-pre.0 03 Jun 2026 H1 MIT Yes Details →
0.0.0-experimental-8cee090e4 03 Jun 2026 none MIT — Details →
6.30.4 29 May 2026 M2 MIT Yes Details →
0.0.0-experimental-f7761f1cd 28 May 2026 none MIT — Details →
7.16.0 28 May 2026 H2 M3 MIT Yes Details →
0.0.0-experimental-ce4015162 26 May 2026 none MIT — Details →
7.15.1 14 May 2026 H2 M3 MIT Yes Details →
0.0.0-experimental-abc385596 13 May 2026 none MIT — Details →
0.0.0-experimental-073f56f6c 11 May 2026 none MIT — Details →
7.15.0 05 May 2026 H2 M3 L1 MIT Yes Details →
0.0.0-experimental-51412399d 05 May 2026 none MIT — Details →
0.0.0-experimental-34996874d 22 Apr 2026 none MIT — Details →
7.14.2 21 Apr 2026 H3 M3 L1 MIT Yes Details →
0.0.0-experimental-689d76079 20 Apr 2026 none MIT — Details →
7.14.1 13 Apr 2026 H4 M3 L1 MIT Yes Details →
0.0.0-nightly-4547c8015-20260410 10 Apr 2026 none MIT — Details →
0.0.0-experimental-cb0fdf114 10 Apr 2026 none MIT — Details →
0.0.0-experimental-58b44aa83 10 Apr 2026 none MIT — Details →
0.0.0-nightly-5ac7a7290-20260404 04 Apr 2026 none MIT — Details →
0.0.0-nightly-80c67a953-20260403 03 Apr 2026 none MIT — Details →
7.14.0 02 Apr 2026 H4 M4 L1 MIT Yes Details →
7.14.0-pre.0 31 Mar 2026 H4 M4 L1 MIT Yes Details →
0.0.0-nightly-fbe4951b9-20260326 26 Mar 2026 none MIT — Details →
0.0.0-nightly-44c3d6ba9-20260325 25 Mar 2026 none MIT — Details →
0.0.0-nightly-111f3a3f2-20260324 24 Mar 2026 none MIT — Details →
7.13.2 23 Mar 2026 H5 M4 L1 MIT Yes Details →
0.0.0-nightly-18bac808f-20260323 23 Mar 2026 none MIT — Details →
0.0.0-nightly-19e1f0f2c-20260321 21 Mar 2026 none MIT — Details →
0.0.0-nightly-b897f185f-20260319 19 Mar 2026 none MIT — Details →
7.13.2-pre.0 18 Mar 2026 H5 M4 L1 MIT Yes Details →
0.0.0-nightly-1cd923e38-20260318 18 Mar 2026 none MIT — Details →
0.0.0-nightly-7f1014972-20260313 13 Mar 2026 none MIT — Details →
0.0.0-nightly-7d21b1c15-20260311 11 Mar 2026 none MIT — Details →
0.0.0-nightly-c5012af14-20260305 05 Mar 2026 none MIT — Details →
0.0.0-nightly-7990dd5d5-20260303 03 Mar 2026 none MIT — Details →
0.0.0-experimental-567b27f71 02 Mar 2026 none MIT — Details →
0.0.0-nightly-bbe4a7317-20260228 28 Feb 2026 none MIT — Details →
0.0.0-nightly-d8ffb2dbd-20260224 24 Feb 2026 none MIT — Details →
7.13.1 23 Feb 2026 H6 M5 L1 MIT Yes Details →
0.0.0-nightly-5745c4ba3-20260220 20 Feb 2026 none MIT — Details →
0.0.0-nightly-db7eb57d1-20260219 19 Feb 2026 none MIT — Details →
7.13.1-pre.0 18 Feb 2026 H6 M5 L1 MIT Yes Details →
0.0.0-nightly-6dda561b4-20260218 18 Feb 2026 none MIT — Details →
0.0.0-nightly-b66e632db-20260213 13 Feb 2026 none MIT — Details →
0.0.0-experimental-56b72276e 12 Feb 2026 none MIT — Details →
0.0.0-experimental-e067e5e52 10 Feb 2026 none MIT — Details →
0.0.0-nightly-3f168fb75-20260206 06 Feb 2026 none MIT — Details →
0.0.0-nightly-6d4e212a9-20260204 04 Feb 2026 none MIT — Details →
0.0.0-nightly-b643537e8-20260130 30 Jan 2026 none MIT — Details →
0.0.0-nightly-7ca70609b-20260129 29 Jan 2026 none MIT — Details →
0.0.0-experimental-f887449bb 26 Jan 2026 none MIT — Details →
0.0.0-nightly-75dc0063d-20260124 24 Jan 2026 none MIT — Details →
7.13.0 23 Jan 2026 H6 M5 L1 MIT Yes Details →
0.0.0-nightly-6324bb4fe-20260122 22 Jan 2026 none MIT — Details →
0.0.0-nightly-3126264a6-20260121 21 Jan 2026 none MIT — Details →
7.13.0-pre.0 20 Jan 2026 H6 M5 L1 MIT Yes Details →
0.0.0-nightly-3a5b5ad0e-20260117 17 Jan 2026 none MIT — Details →
0.0.0-nightly-f29c6c956-20260116 16 Jan 2026 none MIT — Details →
0.0.0-nightly-28605c834-20260113 13 Jan 2026 none MIT — Details →
0.0.0-nightly-9987ba0a2-20260109 09 Jan 2026 none MIT — Details →
0.0.0-experimental-3fe27584d 08 Jan 2026 none MIT — Details →
0.0.0-nightly-c38d76ce4-20260108 08 Jan 2026 none MIT — Details →
6.30.3 07 Jan 2026 M2 MIT Yes Details →
7.12.0 07 Jan 2026 H6 M5 L1 MIT Yes Details →
0.0.0-nightly-0ef10abcd-20260107 07 Jan 2026 none MIT — Details →
6.30.3-pre-v6.0 06 Jan 2026 M2 MIT Yes Details →
7.12.0-pre.0 06 Jan 2026 H6 M5 L1 MIT Yes Details →
0.0.0-nightly-041c7b10b-20260106 06 Jan 2026 none MIT — Details →
0.0.0-nightly-7394407ae-20251224 24 Dec 2025 none MIT — Details →
0.0.0-nightly-30f6c1d81-20251220 20 Dec 2025 none MIT — Details →
0.0.0-nightly-915694ead-20251219 19 Dec 2025 none MIT — Details →
0.0.0-nightly-7ad685377-20251218 18 Dec 2025 none MIT — Details →
7.11.0 17 Dec 2025 H7 M6 — Yes Details →
0.0.0-nightly-60e382aff-20251216 16 Dec 2025 none — — Details →
7.11.0-pre.0 15 Dec 2025 H7 M6 — Yes Details →
0.0.0-nightly-7c7325139-20251213 13 Dec 2025 none — — Details →
0.0.0-nightly-0206276a4-20251212 12 Dec 2025 none — — Details →
0.0.0-experimental-f9e19c91c 12 Dec 2025 none — — Details →
0.0.0-experimental-653010f49 11 Dec 2025 none — — Details →
0.0.0-experimental-df9e1151a 11 Dec 2025 none — — Details →
0.0.0-experimental-22117d3a9 11 Dec 2025 none — — Details →
0.0.0-nightly-22117d3a9-20251211 11 Dec 2025 none — — Details →
0.0.0-nightly-4e9bd3504-20251210 10 Dec 2025 none — — Details →
0.0.0-experimental-2a296c713 09 Dec 2025 none — — Details →
0.0.0-experimental-6f53aff26 09 Dec 2025 none — — Details →
0.0.0-experimental-3cde40396 09 Dec 2025 none — — Details →
0.0.0-nightly-90e07f167-20251206 06 Dec 2025 none — — Details →
0.0.0-nightly-2f9ffa560-20251205 05 Dec 2025 none — — Details →
7.10.1 04 Dec 2025 H7 M5 — Yes Details →
0.0.0-nightly-1954672a2-20251204 04 Dec 2025 none — — Details →
7.10.1-pre.0 03 Dec 2025 H7 M5 — Yes Details →
0.0.0-experimental-f8522255d 03 Dec 2025 none — — Details →

The newest 120 of 1,188 versions Vulert tracks. Severity counts are the vulnerabilities recorded against that exact release.

02 Disclosure history

How often vulnerabilities are recorded

  • 2025 2
  • 2026 17

Counted by the year Vulert recorded each vulnerability — the same date the table below shows as disclosed. 17 of the 19 were recorded in the last 12 months.

03 Vulnerabilities

Recorded vulnerabilities for react-router

The 5 most severe of 19 vulnerabilities recorded for this package

Search all 19 in the database →
Vulnerability Severity Fixed version ↓ Disclosed ↓
CVE-2026-55685: React Router Unauthenticated Denial of Service via Inefficient Route Matching 8.7 high 7.18.0 24 Jul 2026
Data Spoofing Vulnerability in React Router: Pre-render Data Manipulation 8.2 high 7.5.2 24 Apr 2025
CVE-2026-21884: React Router SSR XSS Vulnerability in ScrollRestoration 8.2 high 7.12.0 08 Jan 2026
CVE-2026-42211: React Router Arbitrary Constructor Invocation via TYPE_ERROR Deserialization 8.1 high 7.14.2 03 Jun 2026
XSS Vulnerability in React Router: Open Redirects Risk 8.0 high 7.12.0 08 Jan 2026

Vulnerability wrong, a fix missing, or a package we should cover? Report it and we will fix the record. Report Vulnerability Provide Feedback

Updated: 23/Oct/2026 · Vulnerabilities in our DB: 524315

Subscribe to Vulert on Telegram
Daily digest of new CVEs, critical and high severity, affected packages and fixes — plus a weekly roundup.
Join the channel →

Questions

About react-router

Is react-router safe to use?

Vulert records 19 vulnerabilities for react-router in npm: 0 critical, 11 high, 7 medium and 1 low. Every one of them has a published fix, so the practical answer is to run a supported release and keep it patched.

What is react-router's Vulert package health score?

Vulert scores react-router 66/100, which reads as usable, but worth attention. The score weighs the vulnerability record (40), maintenance and release cadence (25), adoption from dependents and stars (20) and community signals such as the OpenSSF scorecard and forks (15).

Is the latest version of react-router affected?

No. 8.5.0, the version you would install today, has no vulnerabilities on record against it. Earlier releases do — the version table above lists each release with what affects it.

How many vulnerabilities does react-router have?

19 vulnerabilities are recorded for react-router in the npm ecosystem: 0 critical, 11 high, 7 medium and 1 low. The ledger on this page lists the same counts next to the date of the most recent disclosure.

How often are new react-router vulnerabilities disclosed?

17 vulnerabilities were recorded for react-router in the last 12 months, and the oldest entry in this database dates to 24 Apr 2025. Recency matters more than a lifetime total: it shows how actively new issues are being disclosed for the package you are considering.

Which versions of react-router are affected?

Each vulnerability on this page lists the affected version range and the fixed version to move to. Open the vulnerability for the version you actually run — fixes are specific to a release line, not to the package as a whole.

How do I monitor react-router for upcoming vulnerabilities?

Upload the manifest or SBOM for your application at vulert.com/scanner and Vulert keeps checking the react-router version you actually run against new disclosures, then alerts you when one affects it. There is no installation and no source-code access required.