CVE-2026-53667: React Router XSS Vulnerability in RSCErrorHandler
Summary
CVE-2026-53667: React Router: RSCErrorHandler Missing Protocol Validation (XSS). Affects react-router versions >= 7.11.0, < 7.18.0. Fixed in 7.18.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
React Router is a popular JavaScript library used for routing in React applications. It enables developers to create dynamic single-page applications by managing navigation and rendering of components based on the URL. The library provides a robust set of features, including nested routing, code splitting, and support for server-side rendering. However, a recent vulnerability has been identified in the unstable RSC (React Server Components) error handling path, which could expose applications to cross-site scripting (XSS) attacks if not addressed.
Vulnerability Detail
The vulnerability arises from a flaw in the RSC error handling mechanism where redirects from untrusted sources can lead to XSS attacks. Attackers can exploit this by supplying malicious redirect targets, potentially allowing them to execute arbitrary scripts in the context of the user's browser. This issue is particularly concerning as it affects applications utilizing the unstable RSC APIs, which may not have been thoroughly vetted for security.
How To Fix
Latest published version: 8.5.0 as of 23 Oct 2026
npm install react-router@8.5.0Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
7.18.0
This is the first release that contains the fix.
npm install react-router@7.18.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, developers should avoid using the unstable RSC APIs until the package is updated. Additionally, implement strict validation of redirect targets to ensure they originate from trusted sources.
Conclusion
In summary, CVE-2026-53667 presents a significant risk for applications using React Router's unstable RSC APIs due to potential XSS vulnerabilities. It is crucial to update to the latest patched version to mitigate this risk and ensure the security of your application.
See every vulnerability recorded for react-router →
FAQ
CVE-2026-53667 is a vulnerability in React Router that allows for potential XSS attacks due to improper handling of redirects in the RSC error handling path.
You can check if your application is affected by using Vulert, which monitors open-source vulnerabilities in your software. Visit Vulert Scanner to analyze your package-lock.json file.
The CVSS score for this vulnerability is 6.9, indicating a moderate level of severity.
If immediate updates are not feasible, consider implementing strict validation for redirect targets and refrain from using the unstable RSC APIs as a temporary measure.
You can find more information about vulnerabilities in React Router by visiting the official GitHub advisory page or the React Router documentation.
References
Related vulnerabilities
Recent vulnerabilities recorded for react-router.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
