GitHub Advisoryadvisory · npm
GHSA-2j2x-hqr9-3h42 React Router's same-origin redirect with path starting // causes open redirect via protocol-relative URL reinterpretation
MEDIUM
Official page ↗
- Aliases
- CVE-2026-40181
- Ecosystem
- npm
- Packages
- react-router, @remix-run/router
- Severity
- Moderate
- CVSS vector
- CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:U
- Weaknesses
- CWE-601
- Reviewed
- 2026-06-03
Affected packages
• npm react-router: >= 7.0.0, < 7.14.1 → fixed in 7.14.1
• npm react-router: >= 6.7.0, < 6.30.4 → fixed in 6.30.4
• npm @remix-run/router: >= 1.3.0, < 1.23.3 → fixed in 1.23.3
Description
Certain URLs passed to the `redirect` function can trigger an open redirect to an external domain depending on the level of validation done by the application prior to returning the `redirect`.
> [!NOTE]
> This does not impact your React Router application if you are using Declarative Mode (``)
Related
Alias · CVE (1)
- CVE-2026-40181 React Router is a router for React. vulnerability
Weakness · CWE (1)
- CWE-601 URL Redirection to Untrusted Site weakness