CVE-2026-53667

React Router is a router for React. In versions 7.11.0 through 7.17.0, the RSCErrorHandler is missing protocol validation, allowing for redirects from untrusted sources. This issue is a follow up to CVE-2026-53667, and only affects consuming applications if they are using the unstable RSC APIs. This issue has been fixed in version 7.18.0.

• CWE-79

• https://github.com/remix-run/react-router/blob/main/CHANGELOG.md#v7180Release Notes
• https://github.com/remix-run/react-router/commit/ce596e823f0d7b883a433af1d5a839a8b9fe0242Patch
• https://github.com/remix-run/react-router/pull/15177Issue Tracking, Patch
• https://github.com/remix-run/react-router/releases/tag/react-router@7.18.0Release Notes
• https://github.com/remix-run/react-router/security/advisories/GHSA-h8fp-f39c-q6mhThird Party Advisory

Published

Jul 27, 2026

Last Modified

Aug 3, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-53657Lima launches Linux virtual machines, typically on macOS, fo…8.2
• CVE-2026-5366Prefect version 3.6.23 is vulnerable to remote code executio…9.9
• CVE-2026-53661Boruta is a standalone authorization server that aims to imp…8.8
• CVE-2026-53662immich is a high performance self-hosted photo and video man…9.6
• CVE-2026-53663React Router is a router for React. From 7.12.0 until 7.15.1…3.1
• CVE-2026-53666React Router is a router for React. In versions 6.4.0 throug…6.1
• CVE-2026-53668React Router is a router for React. In versions 6.30.2 throu…6.9
• CVE-2026-53669React Router is a router for React. Versions 6.0.0 through 7…6.1
• CVE-2026-5367A flaw was found in OVN (Open Virtual Network). A remote att…8.6
• CVE-2026-53673BuddyPress 14.4.0 contains an insecure direct object referen…8.6
• CVE-2026-53674BuddyPress 14.4.0 contains a regular expression injection vu…7.1
• CVE-2026-53675BuddyPress 14.4.0 contains an insecure direct object referen…5.3