High 8.0Published Jan 9, 2026

CVE-2026-22029React Router vulnerable to XSS via Open Redirects

Updated under an hour ago (Oct 27, 2026, 5:23 PM ET)

Does this affect you?

It affects remix-run react-router and 43 other products. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for remix-run react-router

Exploited in the last 30 days

React Router is a router for React. In @remix-run/router version prior to 1.23.2 and react-router 7.0.0 through 7.11.0, React Router (and Remix v1/v2) SPA open navigation redirects originating from loaders or actions in Framework Mode, Data Mode, or the unstable RSC modes can result in unsafe URLs causing unintended javascript execution on the client. This is only an issue if you are creating redirect paths from untrusted content or via an open redirect. There is no impact if Declarative Mode (<BrowserRouter>) is being used. This issue has been patched in @remix-run/router version 1.23.2 and react-router version 7.12.0.

CVSS: 8.0 HIGH (v3.1, CNA)CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:N
Weakness (CWE): CWE-79
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: GitHub_M
NVD analysis: Modified
Record last updated: Sep 10, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

remix-run react-router remix_run:react_router (from the name)	from 7.0.0, < 7.12.0	CNA record
remix-run @remix-run/router remix_run:router (from the name)	before 1.23.2	CNA record
Red Hat Red Hat Ansible Automation Platform 2.5 for RHEL 8 redhat:ansible_automation_platform	from 0:2.5.20260225-1.el8ap not affected	CISA ADP
Red Hat multicluster engine for Kubernetes 2.1 redhat:multicluster_engine	from 1777128790 not affected	CISA ADP
Red Hat Red Hat Advanced Cluster Management for Kubernetes 2.11 redhat:acm	from 1783350952 not affected	CISA ADP
Red Hat Red Hat Advanced Cluster Security 4.8 redhat:advanced_cluster_security	from 1769615659 not affected	CISA ADP
Red Hat Red Hat Discovery 2 redhat:discovery	from 1770913709 not affected	CISA ADP
Red Hat Red Hat Edge Manager 1.0 redhat:edge_manager	from 1783502765 not affected	CISA ADP
Red Hat Red Hat Migration Toolkit 1.8 redhat:rhmt	from 1783690532 not affected	CISA ADP
Red Hat Red Hat OpenShift AI 2.25 redhat:openshift_ai	from 1772093424 not affected	CISA ADP
1–10 of 44

References

References

https://github.com/remix-run/react-router/security/advisories/GHSA-2w69-qvjg-hvjx	x-refsource-confirm, vendor-advisory
https://access.redhat.com/errata/RHSA-2026:13542
https://access.redhat.com/errata/RHSA-2026:13548
https://access.redhat.com/errata/RHSA-2026:1517
https://access.redhat.com/errata/RHSA-2026:17468
https://access.redhat.com/errata/RHSA-2026:17469
https://access.redhat.com/errata/RHSA-2026:17474
https://access.redhat.com/errata/RHSA-2026:19712
https://access.redhat.com/errata/RHSA-2026:20041
https://access.redhat.com/errata/RHSA-2026:20042
1–10 of 25

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.