CVE-2026-55685

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-55685

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-55685.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-55685

Aliases

GHSA-chx6-hx7r-mcp5

Related

Published

2026-07-27T21:45:57.751Z

Modified

2026-07-28T04:02:41.201740654Z

Severity

8.7 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N CVSS Calculator

Summary

React Router: Unauthenticated Denial of Service via Inefficient Route Matching

Details

React Router is a router for React. In versions 7.0.0 through 7.17.0, the manifest endpoint could be accessed via unauthenticated targeted requests that would put heavy load on the server and slow down response times. This issue is a follow up to CVE-2026-42342, and does not does not impact React Router applications using Declarative Mode (<BrowserRouter>) or Data Mode (createBrowserRouter/<RouterProvider>). This issue has been fixed in version 7.18.0.

Database specific

{
    "cna_assigner": "GitHub_M",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/55xxx/CVE-2026-55685.json",
    "cwe_ids": [
        "CWE-400",
        "CWE-407"
    ]
}

References

Affected packages

Git / github.com/remix-run/react-router

Affected ranges

Type

GIT

Repo

https://github.com/remix-run/react-router

Events

Introduced

e8e3b004d94a949372e77ce97a543bff5bc6fb89

Fixed

24283e93971e3e4f9f909c0bae63583f173fcd52

Database specific

{
    "extracted_events": [
        {
            "introduced": "7.0.0"
        },
        {
            "fixed": "7.18.0"
        }
    ],
    "source": "AFFECTED_FIELD"
}

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-55685.json"