CVE-2026-55685
Description
A flaw was found in React Router. An unauthenticated attacker can send targeted requests to the manifest endpoint, leading to a denial of service (DoS). This can put a heavy load on the server, significantly slowing down response times and impacting the availability of the application.
Statement
React Router (npm packages react-router and @remix-run/server-runtime) versions 7.0.0 through 7.17.0 expose an unauthenticated manifest endpoint. Repeated, targeted requests to this endpoint place heavy load on the server and can degrade or deny service for other users. This issue is a follow-up to CVE-2026-42342 and is fixed upstream in react-router/@remix-run/server-runtime 7.18.0.
This flaw only affects React Router's Framework Mode, applications that run a Node.js SSR server via @remix-run/server-runtime and serve the manifest endpoint. Applications using Declarative Mode (
Red Hat's CVSS score (6.5, CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) is lower than the CVE.org score because the affected React Router components in Red Hat products are used in internal console UIs that are deployed behind authenticated ingress, reducing the practical attack surface. This mirrors the same re-scoring applied to the predecessor flaw, CVE-2026-42342, for the same endpoint family.
Mitigation
Upgrade to react-router/@remix-run/server-runtime 7.18.0 or later once the fix is packaged in the affected Red Hat product. Where upgrading isn't immediately possible, rate-limiting or restricting access to the manifest endpoint at a reverse proxy or ingress layer can reduce exposure. Products that do not run React Router in Framework Mode (Declarative Mode or Data Mode only) are not affected regardless of the bundled react-router version.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 6.5 | 7.5 | N/A |
| Attack Vector | Network | Network | N/A |
| Attack Complexity | Low | Low | N/A |
| Privileges Required | Low | None | N/A |
| User Interaction | None | None | N/A |
| Scope | Unchanged | Unchanged | N/A |
| Confidentiality | None | None | N/A |
| Integrity Impact | None | None | N/A |
| Availability Impact | High | High | N/A |
Vector
Red Hat: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
NVD: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Red Hat CVSS v3 Score Explanation
PR:L - RH deployments of the affected console UIs sit behind authenticated ingress (OpenShift console OAuth, product login), consistent with the same downgrade applied to the predecessor flaw CVE-2026-42342 for this endpoint family.
Understanding the Weakness (CWE)
Availability
Technical Impact: DoS: Resource Consumption (CPU); DoS: Resource Consumption (Memory); DoS: Resource Consumption (Other)
When allocating resources without limits, an attacker could prevent other systems, applications, or processes from accessing the same type of resource. It can be easy for an attacker to consume many resources by rapidly making many requests or causing larger resources to be used than is needed.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
