Copyright © 2012 Red Hat, Inc. All rights reserved.
Moderate
2026-07-27T21:14:49
react-router: React Router: Information disclosure via client-side constructor execution
6.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CWE-502
React Router is a router for React. In versions 6.4.0 through 7.17.0, if application code was written in a way that allows attacker-supplied input to overwrite certain aspects of errors caught by the SSR process, then it was possible for an attacker to trigger unexpected constructor execution on the client, which would in turn trigger an outbound network request. This is only possible with very specific (and unlikely) application-layer code. Note that this does not impact an application if it is using Declarative Mode. It only impacts Framework Mode and Data Mode applications that perform manual SSR/hydration. This issue has been fixed in version 7.18.0.
A flaw was found in React Router. If an application is configured to allow attacker-supplied input to modify errors during server-side rendering (SSR), a remote attacker could trigger unexpected code execution on the client. This execution could lead to an outbound network request, potentially resulting in limited information disclosure or unintended network activity. This vulnerability specifically affects applications utilizing Framework Mode and Data Mode with manual SSR/hydration.
This Moderate impact flaw in React Router affects applications configured to allow attacker-controlled input to modify server-side rendering (SSR) errors. Exploitation requires specific application-layer code in Framework Mode or Data Mode with manual SSR/hydration, leading to unexpected client-side code execution and potential outbound network requests for limited information disclosure or unintended network activity.
To mitigate this issue, ensure that custom application code does not permit attacker-controlled input to modify error objects during server-side rendering (SSR) when using React Router in Framework or Data Modes. Review and harden application-layer error handling to prevent such overwrites. Applications not requiring Framework or Data Mode SSR should consider utilizing Declarative Mode, which is unaffected.
Cryostat 4
Fix deferred
cryostat-openshift-console-plugin-npm
Cryostat 4
Fix deferred
grafana-infinity-datasource-npm
Cryostat 4
Fix deferred
react-router
Exploit Intelligence
Out of support scope
exploit-intelligence-tech-preview/agent-client-rhel9
Gatekeeper 3
Fix deferred
gatekeeper/gatekeeper-rhel9
Migration Toolkit for Applications 8
Fix deferred
mta/mta-ui-rhel8
Migration Toolkit for Applications 8
Fix deferred
mta/mta-ui-rhel9
Migration Toolkit for Containers
Fix deferred
rhmtc/openshift-migration-ui-rhel8
Migration Toolkit for Virtualization
Out of support scope
migration-toolkit-virtualization/mtv-console-plugin-rhel9
Multicluster Engine for Kubernetes
Fix deferred
multicluster-engine/console-mce-rhel9
Network Observability Operator
Fix deferred
network-observability/network-observability-console-plugin-pf4-rhel9
Network Observability Operator
Fix deferred
network-observability/network-observability-console-plugin-pf5-rhel9
Network Observability Operator
Fix deferred
network-observability/network-observability-console-plugin-rhel9
Node HealthCheck Operator
Out of support scope
workload-availability/node-healthcheck-must-gather-rhel9
Node HealthCheck Operator
Out of support scope
workload-availability/node-healthcheck-operator-bundle
Node HealthCheck Operator
Out of support scope
workload-availability/node-healthcheck-rhel9-operator
OpenShift Lightspeed
Fix deferred
openshift-lightspeed/lightspeed-agentic-console-rhel9
OpenShift Lightspeed
Fix deferred
openshift-lightspeed/lightspeed-console-plugin-419-rhel9
OpenShift Lightspeed
Fix deferred
openshift-lightspeed/lightspeed-console-plugin-pf5-rhel9
OpenShift Lightspeed
Fix deferred
openshift-lightspeed/lightspeed-console-plugin-rhel9
OpenShift Pipelines
Fix deferred
openshift-pipelines/pipelines-console-plugin-pf5-rhel9
OpenShift Pipelines
Fix deferred
openshift-pipelines/pipelines-console-plugin-rhel8
OpenShift Pipelines
Fix deferred
openshift-pipelines/pipelines-console-plugin-rhel9
OpenShift Pipelines
Fix deferred
openshift-pipelines/pipelines-hub-ui-rhel8
OpenShift Pipelines
Fix deferred
openshift-pipelines/pipelines-hub-ui-rhel9
OpenShift Service Mesh 3
Out of support scope
openshift-service-mesh/kiali-operator-bundle
OpenShift Service Mesh 3
Fix deferred
openshift-service-mesh/kiali-ossmc-rhel9
OpenShift Service Mesh 3
Fix deferred
openshift-service-mesh/kiali-rhel9
OpenShift Service Mesh 3
Out of support scope
openshift-service-mesh/kiali-rhel9-operator
Red Hat Advanced Cluster Management for Kubernetes 2
Out of support scope
rhacm2/console-rhel9
Red Hat Advanced Cluster Security 4
Out of support scope
advanced-cluster-security/rhacs-main-rhel8
Red Hat Advanced Cluster Security 4
Fix deferred
advanced-cluster-security/rhacs-main-rhel9
Red Hat AMQ Broker 7
Fix deferred
react-router
Red Hat Ansible Automation Platform 2
Fix deferred
ansible-automation-platform-26/gateway-rhel9
Red Hat Ansible Automation Platform 2
Fix deferred
ansible-automation-platform-27/gateway-rhel9
Red Hat Ansible Automation Platform 2
Fix deferred
ansible-on-clouds/aoc-azure-aap-installer-rhel9
Red Hat Ansible Automation Platform 2
Fix deferred
automation-controller
Red Hat Ansible Automation Platform 2
Fix deferred
automation-eda-controller
Red Hat Ansible Automation Platform 2
Fix deferred
automation-gateway
Red Hat Ansible Automation Platform 2
Fix deferred
automation-hub
Red Hat Ansible Automation Platform 2
Fix deferred
automation-platform-ui
Red Hat Ansible Automation Platform 2
Fix deferred
python3.11-galaxy-ng
Red Hat Ansible Automation Platform 2
Fix deferred
python3.12-galaxy-ng
Red Hat Ansible Automation Platform 2
Fix deferred
python3x-galaxy-ng
Red Hat Ansible Automation Platform 2
Fix deferred
python-galaxy-ng
Red Hat build of Apache Camel for Spring Boot 4
Fix deferred
react-router
Red Hat build of Apache Camel - HawtIO 4
Fix deferred
react-router
Red Hat build of Apicurio Registry 3
Fix deferred
apicurio/apicurio-registry-ui-rhel8
Red Hat build of Apicurio Registry 3
Under investigation
apicurio/apicurio-registry-ui-rhel9
Red Hat Build of Keycloak
Fix deferred
react-router
Red Hat Build of Podman Desktop
Fix deferred
rh-podman-desktop.git
Red Hat Ceph Storage 5
Out of support scope
rhceph/rhceph-5-dashboard-rhel8
Red Hat Ceph Storage 9
Fix deferred
rhceph/alloy-rhel10
Red Hat Connectivity Link 1
Fix deferred
rhcl-1/rhcl-console-plugin-rhel9
Red Hat Data Grid 8
Out of support scope
react-router
Red Hat Developer Hub
Fix deferred
rhdh/rhdh-hub-rhel9
Red Hat Discovery 2
Fix deferred
discovery/discovery-ui-rhel9
Red Hat Edge Manager 1
Fix deferred
rhem/flightctl-ui-ocp-rhel10
Red Hat Edge Manager 1
Fix deferred
rhem/flightctl-ui-ocp-rhel9
Red Hat Edge Manager 1
Fix deferred
rhem/flightctl-ui-rhel10
Red Hat Edge Manager 1
Fix deferred
rhem/flightctl-ui-rhel9
Red Hat Enterprise Linux 10
Fix deferred
cockpit-image-builder
Red Hat Enterprise Linux 10
Not affected
firefox
Red Hat Enterprise Linux 10
Fix deferred
grafana
Red Hat Enterprise Linux 10
Not affected
grafana-pcp
Red Hat Enterprise Linux 10
Fix deferred
ipa
Red Hat Enterprise Linux 10
Fix deferred
opentelemetry-collector
Red Hat Enterprise Linux 10
Not affected
thunderbird
Red Hat Enterprise Linux 8
Fix deferred
cockpit-composer
Red Hat Enterprise Linux 8
Not affected
dotnet5.0-build-reference-packages
Red Hat Enterprise Linux 8
Not affected
grafana
Red Hat Enterprise Linux 8
Not affected
grafana-pcp
Red Hat Enterprise Linux 8
Not affected
pcs
Red Hat Enterprise Linux 8
Not affected
thunderbird
Red Hat Enterprise Linux 9
Fix deferred
cockpit-composer
Red Hat Enterprise Linux 9
Not affected
firefox
Red Hat Enterprise Linux 9
Fix deferred
grafana
Red Hat Enterprise Linux 9
Not affected
grafana-pcp
Red Hat Enterprise Linux 9
Fix deferred
ipa
Red Hat Enterprise Linux 9
Fix deferred
opentelemetry-collector
Red Hat Enterprise Linux 9
Not affected
thunderbird
Red Hat Hardened Images
Not affected
grafana12.4
Red Hat Hardened Images
Not affected
grafana13.1
Red Hat Hardened Images
Not affected
opentelemetry-collector
Red Hat Hardened Images
Not affected
opentelemetry-collector-contrib
Red Hat Hardened Images
Not affected
prometheus3.13
Red Hat Hardened Images
Not affected
prometheus3.5
Red Hat JBoss Enterprise Application Platform 8
Fix deferred
react-router
Red Hat JBoss Enterprise Application Platform Expansion Pack
Fix deferred
react-router
Red Hat OpenShift AI (RHOAI)
Fix deferred
rhoai/odh-dashboard-rhel9
Red Hat OpenShift AI (RHOAI)
Fix deferred
rhoai/odh-mlflow-rhel9
Red Hat OpenShift AI (RHOAI)
Fix deferred
rhoai/odh-mod-arch-automl-rhel9
Red Hat OpenShift AI (RHOAI)
Fix deferred
rhoai/odh-mod-arch-autorag-rhel9
Red Hat OpenShift AI (RHOAI)
Fix deferred
rhoai/odh-mod-arch-eval-hub-rhel9
Red Hat OpenShift AI (RHOAI)
Fix deferred
rhoai/odh-mod-arch-gen-ai-rhel9
Red Hat OpenShift AI (RHOAI)
Fix deferred
rhoai/odh-mod-arch-maas-rhel9
Red Hat OpenShift AI (RHOAI)
Fix deferred
rhoai/odh-mod-arch-mlflow-rhel9
Red Hat OpenShift AI (RHOAI)
Fix deferred
rhoai/odh-mod-arch-model-registry-rhel9
Red Hat OpenShift Container Platform 4
Fix deferred
openshift4/ose-agent-installer-ui-rhel9
Red Hat OpenShift Container Platform 4
Fix deferred
openshift4/ose-console
Red Hat OpenShift Container Platform 4
Fix deferred
openshift4/ose-console-rhel9
Red Hat OpenShift Container Platform 4
Fix deferred
openshift4/ose-monitoring-plugin-rhel8
Red Hat OpenShift Container Platform 4
Fix deferred
openshift4/ose-monitoring-plugin-rhel9
Red Hat Openshift Data Foundation 4
Out of support scope
odf4/ocs-client-console-rhel9
Red Hat Openshift Data Foundation 4
Out of support scope
odf4/odf-console-rhel9
Red Hat Openshift Data Foundation 4
Out of support scope
odf4/odf-multicluster-console-rhel9
Red Hat OpenShift Dev Spaces
Fix deferred
devspaces/dashboard-rhel9
Red Hat OpenShift Dev Spaces
Fix deferred
devspaces/openvsx-rhel9
Red Hat OpenShift distributed tracing 3
Fix deferred
rhosdt/tempo-jaeger-query-rhel9
Red Hat OpenShift GitOps
Fix deferred
openshift-gitops-1/argocd-rhel8
Red Hat OpenShift GitOps
Fix deferred
openshift-gitops-1/argocd-rhel9
Red Hat OpenShift GitOps
Fix deferred
openshift-gitops-1/console-plugin-rhel8
Red Hat OpenShift GitOps
Fix deferred
openshift-gitops-1/console-plugin-rhel9
Red Hat OpenShift Virtualization 4
Out of support scope
container-native-virtualization/kubevirt-console-plugin
Red Hat OpenShift Virtualization 4
Out of support scope
container-native-virtualization/kubevirt-console-plugin-rhel9
Red Hat Quay 3
Out of support scope
quay/quay-rhel8
Red Hat Quay 3
Fix deferred
quay/quay-rhel9
Red Hat Satellite 6
Fix deferred
nodejs-react-router
Red Hat Satellite 6
Fix deferred
nodejs-react-router-dom
Red Hat Satellite 6
Fix deferred
satellite/iop-advisor-frontend-rhel9
Red Hat Satellite 6
Fix deferred
satellite/iop-host-inventory-frontend-rhel9
Red Hat Satellite 6
Fix deferred
satellite/iop-vulnerability-frontend-rhel9
Red Hat Single Sign-On 7
Out of support scope
react-router
Red Hat Trusted Artifact Signer
Out of support scope
rhtas/rhtas-console-ui-rhel9
Red Hat Trusted Profile Analyzer
Fix deferred
rhtpa/rhtpa-trustification-service-rhel9
Red Hat Trusted Profile Analyzer
Fix deferred
rhtpa/rhtpa-rhel10
Secrets Management Console for Red Hat OpenShift
Out of support scope
external-secrets-management/console-plugin-rhel9
Self-service automation portal 2
Fix deferred
ansible-automation-platform/automation-portal
https://www.cve.org/CVERecord?id=CVE-2026-53666
https://nvd.nist.gov/vuln/detail/CVE-2026-53666
https://github.com/remix-run/react-router/blob/main/CHANGELOG.md#v7180
https://github.com/remix-run/react-router/commit/9d22943fd46c8ae4b08236425fa3549e10e9ad1a
https://github.com/remix-run/react-router/pull/15175
https://github.com/remix-run/react-router/releases/tag/react-router@7.18.0
https://github.com/remix-run/react-router/security/advisories/GHSA-337j-9hxr-rhxg