CVE-2026-53666: React Router: Arbitrary Constructor Injection via deserializeErrors() in React Router SSR Hydration
If application code allows attacker supplied input to overwrite certain aspects of errors caught by the SSR process, then it was possible for attacker to trigger unexpected constructor execution on the client which would trigger outbound network traffic. This is only possible with very specific (and unlikely) application layer code.
> [!NOTE] > This does not impact your application if you are using Declarative Mode. This only impacts Framework Mode and Data Mode applications doing manual SSR/hydration
Other sources
React Router is a router for React. In versions 6.4.0 through 7.17.0, if application code was written in a way that allows attacker-supplied input to overwrite certain aspects of errors caught by the SSR process, then it was possible for an attacker to trigger unexpected constructor execution on the client, which would in turn trigger an outbound network request. This is only possible with very specific (and unlikely) application-layer code. Note that this does not impact an application if it is using Declarative Mode. It only impacts Framework Mode and Data Mode applications that perform manual SSR/hydration. This issue has been fixed in version 7.18.0.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
npm/react-routerto a version that resolves this vulnerability.Fixed in 7.18.0 - Upgrade
Upgrade
React Routerto a version that resolves this vulnerability.Fixed in 7.18.0
Event History
Frequently Asked Questions
What is the severity of CVE-2026-53666?
The severity of CVE-2026-53666 is rated as medium with a score of 6.1.
How do I fix CVE-2026-53666?
To fix CVE-2026-53666, ensure that your application code properly sanitizes user input to prevent unexpected constructor execution.
What software is affected by CVE-2026-53666?
CVE-2026-53666 affects the npm package react-router.
What are the potential risks of CVE-2026-53666?
The potential risks include the execution of unexpected constructors that could lead to unauthorized outbound network traffic.
When was CVE-2026-53666 published?
CVE-2026-53666 was published on July 23, 2026.