CVE catalog
CVE-2026-42342
React Router is a router for React. In versions 7.0.0 through 7.14.x of react-router and versions 2.10.0 through 2.17.4 of @remix-run/server-runtime, certain crafted requests can consume disproportion
- Severity
- High · CVSS 7.5
- Published
- Source
- [NVD] · [CVE record]
- EPSS
- 0.30% · Oct 27, 2026
React Router is a router for React. In versions 7.0.0 through 7.14.x of react-router and versions 2.10.0 through 2.17.4 of @remix-run/server-runtime, certain crafted requests can consume disproportionate server resources via unbounded path expansion in the __manifest endpoint, resulting in response time degradation and/or service unavailability for end users. This affects React Router Framework Mode applications as well as Remix applications. This does not impact applications using Declarative Mode (`<BrowserRouter>`) or Data Mode (`createBrowserRouter/<RouterProvider>`). This is patched in react-router version 7.15.0 and @remix-run/server-runtime version 2.17.5.
Vulnerable and fixed packages
Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.
| Distribution | Package | Release | Version | Status |
|---|---|---|---|---|
| Cpe | react-router | Not reported | 7.15.0 | fixed |
| Cpe | remix-run\/server-runtime | Not reported | 2.17.5 | fixed |
Fixed-version evidence
| Distribution | Package | Type | Release | Fixed version | Urgency | Origin | Bugs |
|---|---|---|---|---|---|---|---|
| Cpe | react-router | cpe | Not reported | 7.15.0 | Not reported | Not reported | Not reported |
| Cpe | remix-run\/server-runtime | cpe | Not reported | 2.17.5 | Not reported | Not reported | Not reported |
OpenFactory catalog packages
No matching packages in this catalog.
Observed:
References
- [https://access.redhat.com/errata/RHSA-2026:41951]
- [https://ftp.suse.com/pub/projects/security/csaf/suse-su-2026_4585-1.json]
- [https://nvd.nist.gov/vuln/detail/CVE-2026-42342]
- [https://wid.cert-bund.de/.well-known/csaf/white/2026/wid-sec-w-2026-1955.json]
[CERT-Bund public advisories] · [FIRST EPSS] · [National Vulnerability Database (NVD)] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]