CVE-2026-55685: React Router: Unauthenticated Denial of Service via Inefficient Route Matching
React Router is a router for React. In versions 7.0.0 through 7.17.0, the manifest endpoint could be accessed via unauthenticated targeted requests that would put heavy load on the server and slow down response times. This issue is a follow up to CVE-2026-42342, and does not does not impact React Router applications using Declarative Mode (<BrowserRouter>) or Data Mode (createBrowserRouter/<RouterProvider>). This issue has been fixed in version 7.18.0.
Other sources
This is a follow up to https://github.com/remix-run/react-router/security/advisories/GHSA-8x6r-g9mw-2r78 that covers additional reported scenarios in which the manifest endpoint could be accessed via unauthenticated targeted requests that would put heavy load on the server and slow down response times.
> [!NOTE] > This only impacts Framework Mode applications. This does not impact your application if you are using Declarative or Data Mode.
— GitHub
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
npm/react-routerto a version that resolves this vulnerability.Fixed in 7.18.0 - Upgrade
Upgrade
React Routerto a version that resolves this vulnerability.Fixed in 7.18.0
Event History
Frequently Asked Questions
What is the severity of CVE-2026-55685?
CVE-2026-55685 has a risk rating of 36, indicating it poses a significant threat.
What does CVE-2026-55685 impact?
CVE-2026-55685 affects the npm/react-router software, particularly through its manifest endpoint.
How can I mitigate CVE-2026-55685?
Mitigating CVE-2026-55685 involves implementing authentication for requests to the manifest endpoint.
What are the reported scenarios in CVE-2026-55685?
CVE-2026-55685 details scenarios where unauthenticated requests can overload the server, causing performance issues.
When was CVE-2026-55685 published?
CVE-2026-55685 was published on July 24, 2026.