GHSA-chx6-hx7r-mcp5

Suggest an improvement
Source
https://github.com/advisories/GHSA-chx6-hx7r-mcp5
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/07/GHSA-chx6-hx7r-mcp5/GHSA-chx6-hx7r-mcp5.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-chx6-hx7r-mcp5
Aliases
Downstream
CGA (9)
Related
Published
2026-07-24T14:06:57Z
Modified
2026-09-10T03:51:11Z
Severity
  • 8.7 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N CVSS Calculator
Summary
React Router: Unauthenticated Denial of Service via Inefficient Route Matching
Details

This is a follow up to https://github.com/remix-run/react-router/security/advisories/GHSA-8x6r-g9mw-2r78 that covers additional reported scenarios in which the manifest endpoint could be accessed via unauthenticated targeted requests that would put heavy load on the server and slow down response times.

[!NOTE] This only impacts Framework Mode applications. This does not impact your application if you are using Declarative or Data Mode.

Database specific 
{
    "cwe_ids":  [
        "CWE-400",
        "CWE-407"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2026-07-24T14:06:57Z",
    "nvd_published_at":  null,
    "severity":  "HIGH"
}
References

Affected packages

npm / react-router

Package

Name
react-router
View open source insights on deps.dev
Purl
pkg:npm/react-router

Affected ranges

Type
SEMVER
Events
Introduced
7.0.0
Fixed
7.18.0

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/07/GHSA-chx6-hx7r-mcp5/GHSA-chx6-hx7r-mcp5.json"