Copyright © 2012 Red Hat, Inc. All rights reserved.
Moderate
2026-07-27T21:45:57
react-router: @remix-run/server-runtime: React Router: Denial of Service via unauthenticated manifest endpoint requests
6.5
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CWE-770
React Router is a router for React. In versions 7.0.0 through 7.17.0, the manifest endpoint could be accessed via unauthenticated targeted requests that would put heavy load on the server and slow down response times. This issue is a follow up to CVE-2026-42342, and does not does not impact React Router applications using Declarative Mode (<BrowserRouter>) or Data Mode (createBrowserRouter/<RouterProvider>). This issue has been fixed in version 7.18.0.
A flaw was found in React Router. An unauthenticated attacker can send targeted requests to the manifest endpoint, leading to a denial of service (DoS). This can put a heavy load on the server, significantly slowing down response times and impacting the availability of the application.
React Router (npm packages react-router and @remix-run/server-runtime) versions 7.0.0 through 7.17.0 expose an unauthenticated manifest endpoint. Repeated, targeted requests to this endpoint place heavy load on the server and can degrade or deny service for other users. This issue is a follow-up to CVE-2026-42342 and is fixed upstream in react-router/@remix-run/server-runtime 7.18.0.
This flaw only affects React Router's Framework Mode, applications that run a Node.js SSR server via @remix-run/server-runtime and serve the manifest endpoint. Applications using Declarative Mode (<BrowserRouter>) or Data Mode (createBrowserRouter/<RouterProvider>) do not run this server-side code path and are not affected. Simply bundling react-router does not by itself make a product exploitable; each console/UI component must be independently assessed by its owning team for Framework Mode usage and manifest endpoint exposure.
Red Hat's CVSS score (6.5, CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) is lower than the CVE.org score because the affected React Router components in Red Hat products are used in internal console UIs that are deployed behind authenticated ingress, reducing the practical attack surface. This mirrors the same re-scoring applied to the predecessor flaw, CVE-2026-42342, for the same endpoint family.
Upgrade to react-router/@remix-run/server-runtime 7.18.0 or later once the fix is packaged in the affected Red Hat product. Where upgrading isn't immediately possible, rate-limiting or restricting access to the manifest endpoint at a reverse proxy or ingress layer can reduce exposure. Products that do not run React Router in Framework Mode (Declarative Mode or Data Mode only) are not affected regardless of the bundled react-router version.
Cryostat 4
Not affected
cryostat-openshift-console-plugin-npm
Cryostat 4
Not affected
grafana-infinity-datasource-npm
Cryostat 4
Not affected
react-router
Exploit Intelligence
Affected
exploit-intelligence-tech-preview/agent-client-rhel9
Gatekeeper 3
Not affected
gatekeeper/gatekeeper-rhel9
Migration Toolkit for Applications 8
Not affected
mta/mta-ui-rhel8
Migration Toolkit for Applications 8
Not affected
mta/mta-ui-rhel9
Migration Toolkit for Containers
Not affected
rhmtc/openshift-migration-ui-rhel8
Migration Toolkit for Virtualization
Not affected
migration-toolkit-virtualization/mtv-console-plugin-rhel9
Multicluster Engine for Kubernetes
Not affected
multicluster-engine/console-mce-rhel9
Network Observability Operator
Not affected
network-observability/network-observability-console-plugin-pf4-rhel9
Network Observability Operator
Not affected
network-observability/network-observability-console-plugin-pf5-rhel9
Network Observability Operator
Fix deferred
network-observability/network-observability-console-plugin-rhel9
Node HealthCheck Operator
Not affected
workload-availability/node-healthcheck-must-gather-rhel9
Node HealthCheck Operator
Not affected
workload-availability/node-healthcheck-operator-bundle
Node HealthCheck Operator
Not affected
workload-availability/node-healthcheck-rhel9-operator
OpenShift Lightspeed
Fix deferred
openshift-lightspeed/lightspeed-agentic-console-rhel9
OpenShift Lightspeed
Not affected
openshift-lightspeed/lightspeed-console-plugin-419-rhel9
OpenShift Lightspeed
Not affected
openshift-lightspeed/lightspeed-console-plugin-pf5-rhel9
OpenShift Lightspeed
Fix deferred
openshift-lightspeed/lightspeed-console-plugin-rhel9
OpenShift Pipelines
Not affected
openshift-pipelines/pipelines-console-plugin-pf5-rhel9
OpenShift Pipelines
Not affected
openshift-pipelines/pipelines-console-plugin-rhel8
OpenShift Pipelines
Fix deferred
openshift-pipelines/pipelines-console-plugin-rhel9
OpenShift Pipelines
Not affected
openshift-pipelines/pipelines-hub-ui-rhel8
OpenShift Pipelines
Not affected
openshift-pipelines/pipelines-hub-ui-rhel9
OpenShift Service Mesh 3
Not affected
openshift-service-mesh/kiali-operator-bundle
OpenShift Service Mesh 3
Not affected
openshift-service-mesh/kiali-ossmc-rhel9
OpenShift Service Mesh 3
Not affected
openshift-service-mesh/kiali-rhel9
OpenShift Service Mesh 3
Not affected
openshift-service-mesh/kiali-rhel9-operator
Red Hat Advanced Cluster Management for Kubernetes 2
Not affected
rhacm2/console-rhel9
Red Hat Advanced Cluster Security 4
Not affected
advanced-cluster-security/rhacs-main-rhel8
Red Hat Advanced Cluster Security 4
Not affected
advanced-cluster-security/rhacs-main-rhel9
Red Hat AMQ Broker 7
Not affected
react-router
Red Hat Ansible Automation Platform 2
Fix deferred
ansible-automation-platform-26/gateway-rhel9
Red Hat Ansible Automation Platform 2
Fix deferred
ansible-automation-platform-27/gateway-rhel9
Red Hat Ansible Automation Platform 2
Fix deferred
ansible-on-clouds/aoc-azure-aap-installer-rhel9
Red Hat Ansible Automation Platform 2
Not affected
automation-controller
Red Hat Ansible Automation Platform 2
Not affected
automation-eda-controller
Red Hat Ansible Automation Platform 2
Not affected
automation-gateway
Red Hat Ansible Automation Platform 2
Not affected
automation-hub
Red Hat Ansible Automation Platform 2
Fix deferred
automation-platform-ui
Red Hat Ansible Automation Platform 2
Not affected
python3.11-galaxy-ng
Red Hat Ansible Automation Platform 2
Not affected
python3.12-galaxy-ng
Red Hat Ansible Automation Platform 2
Not affected
python3x-galaxy-ng
Red Hat Ansible Automation Platform 2
Not affected
python-galaxy-ng
Red Hat build of Apache Camel for Spring Boot 4
Not affected
react-router
Red Hat build of Apache Camel - HawtIO 4
Not affected
react-router
Red Hat build of Apicurio Registry 3
Fix deferred
apicurio/apicurio-registry-ui-rhel8
Red Hat Build of Keycloak
Not affected
react-router
Red Hat Build of Podman Desktop
Not affected
rh-podman-desktop.git
Red Hat Ceph Storage 5
Not affected
rhceph/rhceph-5-dashboard-rhel8
Red Hat Ceph Storage 9
Not affected
rhceph/alloy-rhel10
Red Hat Connectivity Link 1
Not affected
rhcl-1/rhcl-console-plugin-rhel9
Red Hat Data Grid 8
Fix deferred
react-router
Red Hat Developer Hub
Not affected
rhdh/rhdh-hub-rhel9
Red Hat Discovery 2
Not affected
discovery/discovery-ui-rhel9
Red Hat Edge Manager 1
Not affected
rhem/flightctl-ui-ocp-rhel10
Red Hat Edge Manager 1
Not affected
rhem/flightctl-ui-ocp-rhel9
Red Hat Edge Manager 1
Not affected
rhem/flightctl-ui-rhel10
Red Hat Edge Manager 1
Not affected
rhem/flightctl-ui-rhel9
Red Hat Enterprise Linux 10
Not affected
grafana
Red Hat Enterprise Linux 10
Fix deferred
ipa
Red Hat Enterprise Linux 8
Not affected
dotnet5.0-build-reference-packages
Red Hat Enterprise Linux 8
Not affected
pcs
Red Hat Enterprise Linux 9
Fix deferred
ipa
Red Hat Hardened Images
Not affected
opentelemetry-collector
Red Hat Hardened Images
Not affected
opentelemetry-collector-contrib
Red Hat Hardened Images
Not affected
prometheus3.13
Red Hat Hardened Images
Not affected
prometheus3.5
Red Hat JBoss Enterprise Application Platform 8
Not affected
react-router
Red Hat JBoss Enterprise Application Platform Expansion Pack
Not affected
react-router
Red Hat OpenShift AI (RHOAI)
Affected
rhoai/odh-dashboard-rhel9
Red Hat OpenShift AI (RHOAI)
Not affected
rhoai/odh-mlflow-rhel9
Red Hat OpenShift AI (RHOAI)
Affected
rhoai/odh-mod-arch-automl-rhel9
Red Hat OpenShift AI (RHOAI)
Affected
rhoai/odh-mod-arch-autorag-rhel9
Red Hat OpenShift AI (RHOAI)
Affected
rhoai/odh-mod-arch-eval-hub-rhel9
Red Hat OpenShift AI (RHOAI)
Affected
rhoai/odh-mod-arch-gen-ai-rhel9
Red Hat OpenShift AI (RHOAI)
Affected
rhoai/odh-mod-arch-maas-rhel9
Red Hat OpenShift AI (RHOAI)
Affected
rhoai/odh-mod-arch-mlflow-rhel9
Red Hat OpenShift AI (RHOAI)
Affected
rhoai/odh-mod-arch-model-registry-rhel9
Red Hat OpenShift Container Platform 4
Not affected
openshift4/ose-agent-installer-ui-rhel9
Red Hat OpenShift Container Platform 4
Not affected
openshift4/ose-console
Red Hat OpenShift Container Platform 4
Fix deferred
openshift4/ose-console-rhel9
Red Hat OpenShift Container Platform 4
Not affected
openshift4/ose-monitoring-plugin-rhel8
Red Hat OpenShift Container Platform 4
Fix deferred
openshift4/ose-monitoring-plugin-rhel9
Red Hat Openshift Data Foundation 4
Not affected
odf4/ocs-client-console-rhel9
Red Hat Openshift Data Foundation 4
Not affected
odf4/odf-console-rhel9
Red Hat Openshift Data Foundation 4
Not affected
odf4/odf-multicluster-console-rhel9
Red Hat OpenShift Dev Spaces
Not affected
devspaces/dashboard-rhel9
Red Hat OpenShift Dev Spaces
Not affected
devspaces/openvsx-rhel9
Red Hat OpenShift distributed tracing 3
Not affected
rhosdt/tempo-jaeger-query-rhel9
Red Hat OpenShift GitOps
Not affected
openshift-gitops-1/argocd-rhel8
Red Hat OpenShift GitOps
Not affected
openshift-gitops-1/argocd-rhel9
Red Hat OpenShift GitOps
Not affected
openshift-gitops-1/console-plugin-rhel8
Red Hat OpenShift GitOps
Not affected
openshift-gitops-1/console-plugin-rhel9
Red Hat OpenShift Virtualization 4
Not affected
container-native-virtualization/kubevirt-console-plugin
Red Hat OpenShift Virtualization 4
Fix deferred
container-native-virtualization/kubevirt-console-plugin-rhel9
Red Hat Quay 3
Fix deferred
quay/quay-rhel8
Red Hat Quay 3
Fix deferred
quay/quay-rhel9
Red Hat Satellite 6
Not affected
nodejs-react-router
Red Hat Satellite 6
Not affected
nodejs-react-router-dom
Red Hat Satellite 6
Not affected
satellite/iop-advisor-frontend-rhel9
Red Hat Satellite 6
Not affected
satellite/iop-host-inventory-frontend-rhel9
Red Hat Satellite 6
Not affected
satellite/iop-vulnerability-frontend-rhel9
Red Hat Single Sign-On 7
Not affected
react-router
Red Hat Trusted Artifact Signer
Not affected
rhtas/rhtas-console-ui-rhel9
Red Hat Trusted Profile Analyzer
Not affected
rhtpa/rhtpa-trustification-service-rhel9
Red Hat Trusted Profile Analyzer
Fix deferred
rhtpa/rhtpa-rhel10
Secrets Management Console for Red Hat OpenShift
Fix deferred
external-secrets-management/console-plugin-rhel9
Self-service automation portal 2
Not affected
ansible-automation-platform/automation-portal
https://www.cve.org/CVERecord?id=CVE-2026-55685
https://nvd.nist.gov/vuln/detail/CVE-2026-55685
https://github.com/remix-run/react-router/blob/main/CHANGELOG.md#v7180
https://github.com/remix-run/react-router/commit/09e6020d1950e54f361f7ad00938ecd4dde60929
https://github.com/remix-run/react-router/pull/15186
https://github.com/remix-run/react-router/releases/tag/react-router@7.18.0
https://github.com/remix-run/react-router/security/advisories/GHSA-8x6r-g9mw-2r78
https://github.com/remix-run/react-router/security/advisories/GHSA-chx6-hx7r-mcp5