React Router is a router for React. In versions 7.0.0 through 7.14.1, when using Framework Mode, a combination of steps could potentially allow unauthorized rem…

Published:

1 juni 2026 om 22:00:00

Alert date:

2 juni 2026 om 21:03:34

Source:

nvd.nist.gov

Web Technologies, Supply Chain & Dependencies

React Router versions 7.0.0 through 7.14.1 contain a vulnerability in Framework Mode that allows unauthorized remote code execution through external requests. The attack requires an existing prototype pollution vulnerability in the application code and uses a 2-step attack process. Applications using Declarative Mode or Data Mode are not affected. The vulnerability is patched in version 7.14.2.

Technical details

Mitigation steps:

Affected products:

React Router