VulertSecurity VulertSecurity

Vulnerability Database · npm · react-router · Version

react-router 7.11.0-pre.0

7.11.0-pre.0 is affected by 13 vulnerabilities.

The vulnerabilities that cover this exact version are listed below with the fixed version to move to.

Critical 0 High 7 Medium 6 Low 0 Unrated 0

All react-router versions & vulnerabilities → Search the database for this package →
Released 15 Dec 2025 Licence MIT Also known from other sources 0 Newer releases 300 Database updated 23/Oct/2026

Release and licence data published by the npm registry. Licence information is not legal advice.

Concerned about your application's security?

Vulert continues monitoring your dependencies and alerts you when new vulnerabilities are disclosed. No installation and no source-code access required.

01 Vulnerabilities affecting this version

react-router 7.11.0-pre.0 vulnerabilities

13 vulnerabilities cover react-router 7.11.0-pre.0. Scroll the table for all of them, or open the full list in the database.

Vulnerability Severity Fixed version Disclosed
CVE-2026-55685: React Router Unauthenticated Denial of Service via Inefficient Route Matching 8.7 high 7.18.0 24 Jul 2026
CVE-2026-21884: React Router SSR XSS Vulnerability in ScrollRestoration 8.2 high 7.12.0 08 Jan 2026
CVE-2026-42211: React Router Arbitrary Constructor Invocation via TYPE_ERROR Deserialization 8.1 high 7.14.2 03 Jun 2026
CVE-2026-33245: React Router XSS Vulnerability in Unstable RSC Redirect Handling 8.0 high 7.13.2 03 Jun 2026
XSS Vulnerability in React Router: Open Redirects Risk 8.0 high 7.12.0 08 Jan 2026
CVE-2026-34077: React Router Denial of Service Vulnerability via Reflected User Input 7.5 high 7.14.0 04 Jun 2026
CVE-2026-42342: React Router DoS Vulnerability via Unbounded Path Expansion 7.5 high 7.15.0 03 Jun 2026
CVE-2026-53667: React Router XSS Vulnerability in RSCErrorHandler 6.9 medium 7.18.0 23 Jul 2026
CVE-2026-40181: React Router Open Redirect via Protocol-Relative URL Reinterpretation 6.6 medium 7.14.1 03 Jun 2026
CSRF Vulnerability in React Router and Remix Server Actions 6.5 medium 7.12.0 08 Jan 2026
CVE-2026-53666: React Router Arbitrary Constructor Injection via deserializeErrors() in SSR Hydration 6.1 medium 7.18.0 23 Jul 2026
CVE-2026-33244: React Router Stored XSS via Unescaped Location Header in Prerendered Redirect HTML 5.4 medium 7.13.2 03 Jun 2026
CVE-2026-53669: React Router Open Redirect via Backslash in <Link> and useNavigate 5.1 medium 7.18.0 23 Jul 2026

Looking for another version, or everything Vulert holds for react-router?

All versions → Full vulnerability list →

Subscribe to Vulert on Telegram
Daily digest of new CVEs, critical and high severity, affected packages and fixes — plus a weekly roundup.
Join the channel →

Questions

About react-router 7.11.0-pre.0

Is react-router 7.11.0-pre.0 vulnerable?

Yes. 13 vulnerabilities in the Vulert database cover react-router 7.11.0-pre.0: 0 critical, 7 high, 6 medium and 0 low. Each entry above names the fixed version to move to.

Is 7.11.0-pre.0 the latest release of react-router?

No. 7.11.0-pre.0 was published 15 Dec 2025, and newer releases exist. Newer is not automatically safer — the version table on the package page shows what each release carries.

How do I monitor react-router for upcoming vulnerabilities?

Upload the manifest or SBOM for your application at vulert.com/scanner and Vulert keeps checking the react-router version you actually run against new disclosures, then alerts you when one affects it. There is no installation and no source-code access required.