CVE-2026-53666: React Router Arbitrary Constructor Injection via deserializeErrors() in SSR Hydration
Summary
CVE-2026-53666: React Router: Arbitrary Constructor Injection via deserializeErrors() in React Router SSR Hydration. Affects react-router versions >= 6.4.0, < 7.18.0. Fixed in 7.18.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
React Router is a popular library for managing navigation and routing in React applications. It enables developers to create single-page applications with dynamic routing capabilities. The library supports various modes, including Declarative Mode, Framework Mode, and Data Mode. This vulnerability specifically affects Framework Mode and Data Mode applications that utilize manual server-side rendering (SSR) and hydration, making them susceptible to certain types of attacks.
Vulnerability Detail
The vulnerability arises when application code permits attacker-supplied input to overwrite aspects of errors caught during the SSR process. This can lead to unexpected constructor execution on the client side, potentially triggering outbound network traffic. However, this scenario is contingent upon very specific and unlikely application layer code configurations. It is important to note that applications using Declarative Mode are not impacted by this vulnerability.
How To Fix
Latest published version: 8.5.0 as of 23 Oct 2026
npm install react-router@8.5.0Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
7.18.0
This is the first release that contains the fix.
npm install react-router@7.18.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If an immediate update is not feasible, consider reviewing your application code to ensure that it does not allow untrusted input to influence error handling during SSR. Implementing strict validation and sanitization of inputs can help mitigate the risk until an update can be applied.
Conclusion
In summary, CVE-2026-53666 is a vulnerability in React Router that allows for arbitrary constructor injection via the deserializeErrors() function during SSR hydration. It is crucial for developers using affected versions to update to the patched version to mitigate potential risks. Additionally, implementing input validation can serve as a temporary workaround.
See every vulnerability recorded for react-router →
FAQ
The CVSS score of this vulnerability is 6.1, indicating a moderate severity level.
Versions of React Router from 6.4.0 up to, but not including, 7.18.0 are affected by this vulnerability.
If an immediate update is not possible, review your application code for potential vulnerabilities and implement input validation and sanitization as a temporary measure.
No, applications using Declarative Mode are not impacted by this vulnerability.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Visit the Vulert playground at Vulert Scanner to check if your application is affected without requiring any signup.
References
Related vulnerabilities
Recent vulnerabilities recorded for react-router.
