GitHub Advisoryadvisory · npm

GHSA-8v8x-cx79-35w7 React Router SSR XSS in ScrollRestoration

HIGH Published 2026-01-08 Modified 2026-09-08 Official page ↗
Aliases
CVE-2026-21884
Ecosystem
npm
Packages
react-router, @remix-run/react
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N
Weaknesses
CWE-79
Reviewed
2026-01-08

Affected packages

• npm react-router: >= 7.0.0, < 7.12.0 → fixed in 7.12.0 • npm @remix-run/react: < 2.17.3 → fixed in 2.17.3

Description

A XSS vulnerability exists in in React Router's `` API in Framework Mode when using the `getKey`/`storageKey` props during Server-Side Rendering which could allow arbitrary JavaScript execution during SSR if untrusted content is used to generate the keys. > [!NOTE] > This does not impact applications if developers have disabled server-side rendering in Framework Mode, or if they are using Declarative Mode (``) or Data Mode (`createBrowserRouter`/``).

Related

Alias · CVE (1)

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References