CVE-2026-53669: React Router: Open redirect via backslash in <Link> and useNavigate (CVE-2025-68470 bypass)
React Router is a router for React. Versions 6.0.0 through 7.17.0 are vulnerable to Open Redirtect through use of backslashes in <Link> and useNavigate. This issue is a follow up to CVE-2025-68470 and has been fixed in version 7.18.0.
Other sources
This is a follow up to CVE-2025-68470. React Router was alerted to certain scenarios in which the fix there was incomplete so there still existed some scenarios where attacker supplied paths passed to navigation mechanisms could result in unexpected external navigations.
— GitHub
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
npm/react-routerto a version that resolves this vulnerability.Fixed in 7.18.0 - Upgrade
Upgrade
react-routerto a version that resolves this vulnerability.Fixed in 7.18.0
Event History
Frequently Asked Questions
What is the severity of CVE-2026-53669?
The severity of CVE-2026-53669 is rated as 42, indicating a significant risk.
How do I fix CVE-2026-53669?
To fix CVE-2026-53669, update to the latest version of React Router that addresses this vulnerability.
What type of vulnerability is CVE-2026-53669?
CVE-2026-53669 is a navigation-related vulnerability in React Router that allows attacker-supplied paths.
What are the potential impacts of CVE-2026-53669?
The potential impacts of CVE-2026-53669 include unauthorized access to navigation paths and possible exposure of sensitive information.
When was CVE-2026-53669 published?
CVE-2026-53669 was published on July 23, 2026.