GitHub Advisoryadvisory · npm

GHSA-337j-9hxr-rhxg React Router: Arbitrary Constructor Injection via deserializeErrors() in React Router SSR Hydration

MEDIUM Published 2026-07-23 Modified 2026-07-23 Official page ↗
Aliases
CVE-2026-53666
Ecosystem
npm
Packages
react-router
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Weaknesses
CWE-470
Reviewed
2026-07-23

Affected packages

• npm react-router: >= 6.4.0, < 7.18.0 → fixed in 7.18.0

Description

If application code allows attacker supplied input to overwrite certain aspects of errors caught by the SSR process, then it was possible for attacker to trigger unexpected constructor execution on the client which would trigger outbound network traffic. This is only possible with very specific (and unlikely) application layer code. > [!NOTE] > This does not impact your application if you are using Declarative Mode. This only impacts Framework Mode and Data Mode applications doing manual SSR/hydration

Related

Alias · CVE (1)

Weakness · CWE (1)

  • CWE-470 Use of Externally-Controlled Input to Select Classes or Code weakness

References