Security · Remix React Router

React Router Patches Client-Side Script Execution Flaw in Loader/Action Redirects (CVE-2026-22029)

·

CVE-2026-22029 affects @remix-run/router before 1.23.2 and react-router 7.0.0 through 7.11.0, where SPA redirects returned from loaders or actions in Framework, Data, or unstable RSC modes can produce unsafe URLs that trigger unintended JavaScript execution in the browser. Exploitation requires redirect paths built from untrusted content or an open redirect; Declarative Mode is unaffected, and fixes are available in @remix-run/router 1.23.2 and react-router 7.12.0.

Related coverage