GitHub Advisoryadvisory · npm
GHSA-9jcx-v3wj-wh4m React Router has unexpected external redirect via untrusted paths
MEDIUM
Official page ↗
- Aliases
- CVE-2025-68470
- Ecosystem
- npm
- Packages
- react-router
- Severity
- Moderate
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
- Weaknesses
- CWE-601
- Reviewed
- 2026-01-08
Affected packages
• npm react-router: >= 6.0.0, < 6.30.2 → fixed in 6.30.2
• npm react-router: >= 7.0.0, < 7.9.6 → fixed in 7.9.6
Description
An attacker-supplied path can be crafted so that when a React Router application navigates to it via `navigate()`, ``, or `redirect()`, the app performs a navigation/redirect to an external URL. This is only an issue if developers pass untrusted content into navigation paths in their application code.
Related
Alias · CVE (1)
- CVE-2025-68470 React Router is a router for React. vulnerability
Weakness · CWE (1)
- CWE-601 URL Redirection to Untrusted Site weakness