React Router is a router for React. In versions 7.7.0 through 7.13.1, when using React Router's unstable React Server Components (RSC) APIs, there is a potentia…

Published:

1 juni 2026 om 22:00:00

Alert date:

2 juni 2026 om 21:03:34

Source:

nvd.nist.gov

Web Technologies, Supply Chain & Dependencies

React Router versions 7.7.0 through 7.13.1 contain a client-side Cross-Site Scripting (XSS) vulnerability in the React Server Components (RSC) redirect handling when redirects come from untrusted sources. The vulnerability only affects applications using the unstable RSC APIs in React Router. The issue has been patched in version 7.13.2. Applications not using the unstable RSC APIs are not impacted by this vulnerability.

Technical details

Mitigation steps:

Affected products:

React Router