CVE-2026-53667: React Router: Cross-site Scripting is Possible due to Missing RSCErrorHandler Protocol Validation (Incomplete fix for CVE-2026-53667)
React Router is a router for React. In versions 7.11.0 through 7.17.0, the RSCErrorHandler is missing protocol validation, allowing for redirects from untrusted sources. This issue is a follow up to CVE-2026-53667, and only affects consuming applications if they are using the unstable RSC APIs. This issue has been fixed in version 7.18.0.
Other sources
This is a follow up to https://github.com/remix-run/react-router/security/advisories/GHSA-8646-j5j9-6r62. React Router was alerted of a code path in the (unstable) RSC error handling path in which redirects from untrusted sources could still result in an XSS vector via attacker-supplied redirect targets
> [!NOTE] > This only affects your application if you are using the unstable RSC APIs
— GitHub
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
npm/react-routerto a version that resolves this vulnerability.Fixed in 7.18.0 - Upgrade
Upgrade
React Routerto a version that resolves this vulnerability.Fixed in 7.18.0Patch GHSA-8646-j5j9-6r62
Event History
Frequently Asked Questions
What is the severity of CVE-2026-53667?
The severity of CVE-2026-53667 is medium with a score of 6.9.
What type of vulnerability is associated with CVE-2026-53667?
CVE-2026-53667 is associated with an XSS vulnerability.
How do I fix CVE-2026-53667?
To fix CVE-2026-53667, update to the latest version of npm/react-router that addresses the issue.
What is the impact of CVE-2026-53667?
CVE-2026-53667 could allow an attacker to exploit untrusted redirects leading to an XSS attack.
What is the affected software for CVE-2026-53667?
The affected software for CVE-2026-53667 is npm/react-router.