REDHAT-BUG-2484116: Medium severity Remix react-router vulnerability
React Router is a router for React. In versions 7.0.0 through 7.14.x of react-router and versions 2.10.0 through 2.17.4 of @remix-run/server-runtime, certain crafted requests can consume disproportionate server resources via unbounded path expansion in the manifest endpoint, resulting in response time degradation and/or service unavailability for end users. This affects React Router Framework Mode applications as well as Remix applications. This does not impact applications using Declarative Mode (<BrowserRouter>) or Data Mode (createBrowserRouter/<RouterProvider>). This is patched in react-router version 7.15.0 and @remix-run/server-runtime version 2.17.5.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
react-routerto a version that resolves this vulnerability.Fixed in 7.15.0 - Upgrade
Upgrade
@remix-run/server-runtimeto a version that resolves this vulnerability.Fixed in 2.17.5
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-2484116?
The severity of REDHAT-BUG-2484116 is classified as medium, with a rating of 4.
How do I fix REDHAT-BUG-2484116?
To fix REDHAT-BUG-2484116, upgrade to react-router version 7.15.0 or higher and @remix-run/server-runtime version 2.18.0 or higher.
What impact does REDHAT-BUG-2484116 have on my application?
REDHAT-BUG-2484116 can lead to disproportionate server resource consumption due to unbounded path expansion in the __manifest endpoint.
Which versions are affected by REDHAT-BUG-2484116?
Versions 7.0.0 through 7.14.x of react-router and versions 2.10.0 through 2.17.4 of @remix-run/server-runtime are affected by REDHAT-BUG-2484116.
Is REDHAT-BUG-2484116 related to a specific software component?
Yes, REDHAT-BUG-2484116 is related to the Remix framework and the react-router package.