Copyright © 2012 Red Hat, Inc. All rights reserved.
Moderate
2026-06-02T17:31:35
react-router: React Router: Denial of Service via client-side Cross-Site Scripting in RSC redirect handling
6.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
CWE-79
React Router is a router for React. In versions 7.7.0 through 7.13.1, when using React Router's unstable React Server Components (RSC) APIs, there is a potential client-side Cross-Site Scripting (XSS) vulnerability in the RSC redirect handling if redirects come from untrusted sources. This does not impact applications that are not using the unstable RSC APIs in React Router. This is patched in version 7.13.2.
A flaw was found in React Router (versions 7.7.0 through 7.13.1). When using the unstable React Server Components (RSC) APIs, insufficient sanitization of redirect targets allows client-side cross-site scripting if redirects originate from untrusted sources. An attacker could inject script that disrupts application availability for the victim user. Applications not using the unstable RSC APIs are not affected. Fixed in React Router 7.13.2.
React Router is vulnerable to client-side XSS in unstable RSC redirect handling when redirects come from untrusted sources. A remote unauthenticated attacker who can cause a victim to follow a crafted redirect (user interaction required) may execute script in the browser context, leading to denial of service. Only affects deployments using unstable RSC APIs (versions 7.7.0–7.13.1); patched in 7.13.2. Affects npm react-router bundles across OpenShift console plugins, AAP, GitOps, RHACM, and other hybrid products.
Red Hat Data Grid 8.6.2
2026-07-20T00:00:00Z
RHSA-2026:41951
react-router
Cryostat 4
Not affected
cryostat-openshift-console-plugin-npm
Cryostat 4
Not affected
grafana-infinity-datasource-npm
Cryostat 4
Not affected
react-router
Exploit Intelligence
Fix deferred
exploit-intelligence-tech-preview/agent-client-rhel9
Gatekeeper 3
Under investigation
gatekeeper/gatekeeper-rhel9
Migration Toolkit for Applications 8
Fix deferred
mta/mta-ui-rhel8
Migration Toolkit for Applications 8
Fix deferred
mta/mta-ui-rhel9
Migration Toolkit for Containers
Fix deferred
rhmtc/openshift-migration-ui-rhel8
Migration Toolkit for Virtualization
Fix deferred
migration-toolkit-virtualization/mtv-console-plugin-rhel9
Migration Toolkit for Virtualization
Fix deferred
mtv-candidate/mtv-console-plugin-rhel9
Multicluster Engine for Kubernetes
Under investigation
multicluster-engine/console-mce-rhel9
Network Observability Operator
Fix deferred
network-observability/network-observability-console-plugin-compat-rhel9
Network Observability Operator
Fix deferred
network-observability/network-observability-console-plugin-rhel9
Node HealthCheck Operator
Fix deferred
workload-availability/node-healthcheck-must-gather-rhel9
Node HealthCheck Operator
Fix deferred
workload-availability/node-healthcheck-operator-bundle
Node HealthCheck Operator
Fix deferred
workload-availability/node-healthcheck-rhel9-operator
OpenShift Lightspeed
Fix deferred
openshift-lightspeed/lightspeed-console-plugin-419-rhel9
OpenShift Lightspeed
Fix deferred
openshift-lightspeed/lightspeed-console-plugin-pf5-rhel9
OpenShift Lightspeed
Fix deferred
openshift-lightspeed/lightspeed-console-plugin-rhel9
OpenShift Pipelines
Fix deferred
openshift-pipelines/pipelines-console-plugin-pf5-rhel9
OpenShift Pipelines
Fix deferred
openshift-pipelines/pipelines-console-plugin-rhel8
OpenShift Pipelines
Fix deferred
openshift-pipelines/pipelines-console-plugin-rhel9
OpenShift Pipelines
Fix deferred
openshift-pipelines/pipelines-hub-ui-rhel8
OpenShift Pipelines
Fix deferred
openshift-pipelines/pipelines-hub-ui-rhel9
OpenShift Service Mesh 2
Fix deferred
openshift-service-mesh/kiali-ossmc-rhel8
OpenShift Service Mesh 2
Fix deferred
openshift-service-mesh/kiali-rhel8
OpenShift Service Mesh 3
Fix deferred
openshift-service-mesh/kiali-operator-bundle
OpenShift Service Mesh 3
Fix deferred
openshift-service-mesh/kiali-ossmc-rhel9
OpenShift Service Mesh 3
Fix deferred
openshift-service-mesh/kiali-rhel9
OpenShift Service Mesh 3
Fix deferred
openshift-service-mesh/kiali-rhel9-operator
Red Hat Advanced Cluster Management for Kubernetes 2
Under investigation
redhat-user-workloads/console-acm-211
Red Hat Advanced Cluster Management for Kubernetes 2
Under investigation
redhat-user-workloads/console-acm-212
Red Hat Advanced Cluster Management for Kubernetes 2
Under investigation
redhat-user-workloads/console-acm-213
Red Hat Advanced Cluster Management for Kubernetes 2
Under investigation
rhacm2/console-rhel9
Red Hat Advanced Cluster Security 4
Fix deferred
advanced-cluster-security/rhacs-main-rhel8
Red Hat AMQ Broker 7
Not affected
react-router
Red Hat Ansible Automation Platform 2
Under investigation
ansible-automation-platform-26/gateway-rhel9
Red Hat Ansible Automation Platform 2
Under investigation
ansible-automation-platform-27/gateway-rhel9
Red Hat Ansible Automation Platform 2
Under investigation
ansible-on-clouds/aoc-azure-aap-installer-rhel9
Red Hat Ansible Automation Platform 2
Under investigation
automation-controller
Red Hat Ansible Automation Platform 2
Under investigation
automation-eda-controller
Red Hat Ansible Automation Platform 2
Under investigation
automation-gateway
Red Hat Ansible Automation Platform 2
Under investigation
automation-hub
Red Hat Ansible Automation Platform 2
Under investigation
automation-platform-ui
Red Hat Ansible Automation Platform 2
Under investigation
python3.11-galaxy-ng
Red Hat Ansible Automation Platform 2
Under investigation
python3.12-galaxy-ng
Red Hat Ansible Automation Platform 2
Under investigation
python3x-galaxy-ng
Red Hat Ansible Automation Platform 2
Under investigation
python-galaxy-ng
Red Hat build of Apache Camel for Spring Boot 4
Not affected
react-router
Red Hat build of Apache Camel - HawtIO 4
Affected
react-router
Red Hat build of Apicurio Registry 2
Out of support scope
react-router
Red Hat build of Apicurio Registry 3
Out of support scope
apicurio/apicurio-registry-ui-rhel8
Red Hat build of Apicurio Registry 3
Out of support scope
apicurio/apicurio-registry-ui-rhel9
Red Hat Build of Keycloak
Out of support scope
react-router
Red Hat Build of Podman Desktop
Under investigation
rh-podman-desktop.git
Red Hat Ceph Storage 5
Fix deferred
rhceph/rhceph-5-dashboard-rhel8
Red Hat Ceph Storage 9
Fix deferred
rhceph/alloy-rhel10
Red Hat Developer Hub
Fix deferred
rhdh/rhdh-hub-rhel9
Red Hat Discovery 2
Under investigation
discovery/discovery-ui-rhel9
Red Hat Edge Manager 1
Under investigation
rhem/flightctl-ui-ocp-rhel10
Red Hat Edge Manager 1
Under investigation
rhem/flightctl-ui-ocp-rhel9
Red Hat Edge Manager 1
Under investigation
rhem/flightctl-ui-rhel10
Red Hat Edge Manager 1
Under investigation
rhem/flightctl-ui-rhel9
Red Hat Enterprise Linux 10
Under investigation
ipa
Red Hat Enterprise Linux 8
Under investigation
cockpit-composer
Red Hat Enterprise Linux 8
Under investigation
dotnet5.0-build-reference-packages
Red Hat Enterprise Linux 8
Under investigation
grafana
Red Hat Enterprise Linux 8
Under investigation
grafana-pcp
Red Hat Enterprise Linux 8
Under investigation
pcs
Red Hat Enterprise Linux 8
Under investigation
thunderbird
Red Hat Enterprise Linux 9
Under investigation
ipa
Red Hat Fuse 7
Out of support scope
react-router
Red Hat JBoss Enterprise Application Platform 8
Not affected
react-router
Red Hat JBoss Enterprise Application Platform Expansion Pack
Out of support scope
react-router
Red Hat OpenShift AI (RHOAI)
Not affected
rhoai/odh-dashboard-rhel8
Red Hat OpenShift AI (RHOAI)
Under investigation
rhoai/odh-dashboard-rhel9
Red Hat OpenShift AI (RHOAI)
Not affected
rhoai/odh-mlflow-rhel9
Red Hat OpenShift AI (RHOAI)
Under investigation
rhoai/odh-mod-arch-automl-rhel9
Red Hat OpenShift AI (RHOAI)
Under investigation
rhoai/odh-mod-arch-autorag-rhel9
Red Hat OpenShift AI (RHOAI)
Under investigation
rhoai/odh-mod-arch-eval-hub-rhel9
Red Hat OpenShift AI (RHOAI)
Under investigation
rhoai/odh-mod-arch-gen-ai-rhel9
Red Hat OpenShift AI (RHOAI)
Under investigation
rhoai/odh-mod-arch-maas-rhel9
Red Hat OpenShift AI (RHOAI)
Under investigation
rhoai/odh-mod-arch-mlflow-rhel9
Red Hat OpenShift AI (RHOAI)
Under investigation
rhoai/odh-mod-arch-model-registry-rhel9
Red Hat OpenShift Container Platform 4
Fix deferred
openshift4/ose-agent-installer-ui-rhel9
Red Hat OpenShift Container Platform 4
Fix deferred
openshift4/ose-console
Red Hat OpenShift Container Platform 4
Fix deferred
openshift4/ose-console-rhel9
Red Hat OpenShift Container Platform 4
Fix deferred
openshift4/ose-monitoring-plugin-rhel8
Red Hat OpenShift Container Platform 4
Fix deferred
openshift4/ose-monitoring-plugin-rhel9
Red Hat OpenShift Container Platform 4
Fix deferred
openshift4/ose-prometheus-alertmanager-rhel9
Red Hat OpenShift Container Platform 4
Fix deferred
redhat-user-workloads/art-images
Red Hat Openshift Data Foundation 4
Fix deferred
odf4/ocs-client-console-rhel9
Red Hat Openshift Data Foundation 4
Fix deferred
odf4/odf-console-rhel9
Red Hat Openshift Data Foundation 4
Fix deferred
odf4/odf-multicluster-console-rhel9
Red Hat Openshift Data Foundation 4
Fix deferred
rhceph-dev/odf4-ocs-client-console-rhel9
Red Hat Openshift Data Foundation 4
Fix deferred
rhceph-dev/odf4-odf-console-rhel9
Red Hat Openshift Data Foundation 4
Fix deferred
rhceph-dev/odf4-odf-multicluster-console-rhel9
Red Hat OpenShift Dev Spaces
Fix deferred
devspaces/dashboard-rhel9
Red Hat OpenShift Dev Spaces
Fix deferred
devspaces/openvsx-rhel9
Red Hat OpenShift distributed tracing 3
Fix deferred
rhosdt/tempo-jaeger-query-rhel9
Red Hat OpenShift GitOps
Fix deferred
openshift-gitops-1/argocd-rhel8
Red Hat OpenShift GitOps
Fix deferred
openshift-gitops-1/argocd-rhel9
Red Hat OpenShift GitOps
Fix deferred
openshift-gitops-1/console-plugin-rhel8
Red Hat OpenShift GitOps
Fix deferred
openshift-gitops-1/console-plugin-rhel9
Red Hat OpenShift Virtualization 4
Fix deferred
container-native-virtualization/kubevirt-console-plugin
Red Hat OpenShift Virtualization 4
Fix deferred
container-native-virtualization/kubevirt-console-plugin-rhel9
Red Hat Process Automation 7
Out of support scope
react-router
Red Hat Quay 3
Fix deferred
quay/quay-rhel8
Red Hat Quay 3
Fix deferred
quay/quay-rhel9
Red Hat Satellite 6
Under investigation
nodejs-react-router
Red Hat Satellite 6
Under investigation
nodejs-react-router-dom
Red Hat Satellite 6
Under investigation
satellite/iop-advisor-frontend-rhel9
Red Hat Satellite 6
Under investigation
satellite/iop-host-inventory-frontend-rhel9
Red Hat Satellite 6
Under investigation
satellite/iop-vulnerability-frontend-rhel9
Red Hat Single Sign-On 7
Out of support scope
react-router
Red Hat Trusted Artifact Signer
Fix deferred
rhtas/rhtas-console-ui-rhel9
Red Hat Trusted Profile Analyzer
Fix deferred
rhtpa/rhtpa-trustification-service-rhel9
Self-service automation portal 2
Under investigation
ansible-automation-platform/automation-portal
https://www.cve.org/CVERecord?id=CVE-2026-34077
https://nvd.nist.gov/vuln/detail/CVE-2026-34077
https://github.com/remix-run/react-router/security/advisories/GHSA-rxv8-25v2-qmq8