Netlify Flags a Third Round of React Router Security Bugs

Netlify posted a changelog entry on July 23 warning customers about five new React Router security vulnerabilities, all closed by upgrading to version 7.18.0, the third round of React Router CVEs disclosed in under two months (Netlify changelog, July 23, 2026).

---

What changed

The GitHub Advisory Database lists five separate issues in this batch. The most concrete is CVE-2026-53668, an open redirect that can escalate to cross-site scripting: an app with an unvalidated redirect target can be pointed at an unexpected external location or a javascript: URL. It carries a moderate 6.9 CVSS score, hits react-router 7.9.6 through 7.12.0 and react-router-dom 6.30.2 through 6.30.4, and was actually patched earlier, in 7.13.0 (GitHub Advisory GHSA-jjmj-jmhj-qwj2). The other four, all rated moderate, followed on July 23: CVE-2026-55685, an unauthenticated denial-of-service path through the framework’s __manifest endpoint; CVE-2026-53667, a missing protocol check in RSCErrorHandler that opens an XSS vector; CVE-2026-53666, arbitrary client-side constructor injection during server-side-rendering hydration; and CVE-2026-53669, an unexpected external redirect via untrusted paths. Upgrading to react-router 7.18.0 covers all five.

This is not React Router’s first fire drill this year. Netlify flagged six CVEs on January 15 and seven more on June 2, including a separate __manifest denial-of-service bug, CVE-2026-42342, that needed 7.15.0 (Netlify changelog, June 2, 2026). Three disclosure rounds in seven months, two of them hitting the same endpoint, is enough that Belgium’s national cybersecurity center, the Centre for Cybersecurity Belgium, issued its own advisory telling React Router sites to patch immediately rather than wait for a routine dependency bump.

Why this matters

Netlify and Vercel both host a large share of the internet’s React Router and Remix Framework Mode apps, so a five-CVE batch like this is a same-day action item, not background reading: bump the react-router (and, where used, @remix-run/server-runtime) dependency, redeploy, and confirm the build picked up 7.18.0. The open redirect and hydration bugs need an attacker to get a user to click a crafted link; the __manifest denial-of-service does not, since it just needs one unauthenticated request against a Framework Mode deployment, which is why it is drawing the most urgent guidance of the five.

The bigger story is cadence. Three CVE rounds since January means teams treating a React Router upgrade as routine maintenance are now doing security patching on a roughly two-month clock, whether they planned for it or not. Pin a dependency-update alert to React Router releases specifically, rather than relying on a general npm audit sweep to catch it next time.

Key Takeaways

• Netlify’s July 23 changelog names five React Router CVEs, all fixed by upgrading to 7.18.0 (CVE-2026-53668 was already patched in 7.13.0).
• The most urgent is CVE-2026-55685, an unauthenticated denial-of-service in the __manifest endpoint used by Framework Mode apps.
• It is the third React Router security disclosure round since January 2026, following six CVEs in January and seven more, including a different __manifest DoS bug, in June.
• Belgium’s Centre for Cybersecurity issued its own advisory urging an immediate patch, a sign this batch is being treated with more urgency than routine version bumps.