CVE-2026-53666

MEDIUM 6.1

React Router: Arbitrary Constructor Injection via deserializeErrors() in React Router SSR Hydration

CVSS Score

6.1

EPSS Score

0.0%

EPSS Percentile

0th

React Router is a router for React. In versions 6.4.0 through 7.17.0, if application code was written in a way that allows attacker-supplied input to overwrite certain aspects of errors caught by the SSR process, then it was possible for an attacker to trigger unexpected constructor execution on the client, which would in turn trigger an outbound network request. This is only possible with very specific (and unlikely) application-layer code. Note that this does not impact an application if it is using Declarative Mode. It only impacts Framework Mode and Data Mode applications that perform manual SSR/hydration. This issue has been fixed in version 7.18.0.

CWE	CWE-470
Vendor	remix-run
Product	react-router
Published	Jul 27, 2026

Stay Ahead of the Next One

Get instant alerts for remix-run react-router

Be the first to know when new medium vulnerabilities affecting remix-run react-router are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Affected Versions

remix-run / react-router

>= 6.4.0, < 7.18.0

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/remix-run/react-router/security/advisories/GHSA-337j-9hxr-rhxg github.com: https://github.com/remix-run/react-router/pull/15175 github.com: https://github.com/remix-run/react-router/commit/9d22943fd46c8ae4b08236425fa3549e10e9ad1a github.com: https://github.com/remix-run/react-router/blob/main/CHANGELOG.md#v7180 github.com: https://github.com/remix-run/react-router/releases/tag/[email protected]