CVE-2026-53667

Summary

React Router: RSCErrorHandler Missing Protocol Validation (XSS)

Severity

medium

CVSS

6.9

EPSS

0.4% (p29)

CWE

CWE-79

Also known as

GHSA-h8fp-f39c-q6mh

Published

2026-07-23

Updated

2026-07-23

Advisory details

This is a follow up to https://github.com/remix-run/react-router/security/advisories/GHSA-8646-j5j9-6r62. React Router was alerted of a code path in the (unstable) RSC error handling path in which redirects from untrusted sources could still result in an XSS vector via attacker-supplied redirect targets

[!NOTE] This only affects your application if you are using the unstable RSC APIs

References

• https://github.com/advisories/GHSA-h8fp-f39c-q6mh
• https://github.com/remix-run/react-router/security/advisories/GHSA-h8fp-f39c-q6mh
• https://github.com/remix-run/react-router/pull/15177
• https://github.com/remix-run/react-router/commit/ce596e823f0d7b883a433af1d5a839a8b9fe0242
• https://github.com/remix-run/react-router/blob/main/CHANGELOG.md#v7180
• https://github.com/remix-run/react-router/releases/tag/react-router@7.18.0

Related advisories

• GHSA-qwww-vcr4-c8h2 — high · npm/react-router
• CVE-2026-55685 — high · npm/react-router
• CVE-2026-53669 — medium · npm/react-router
• CVE-2026-53666 — medium · npm/react-router
• GHSA-cg2g-xh64-v4q7 — critical · npm/dompurify
• CVE-2026-102989 — critical · npm/@tanstack/start-server-core
• CVE-2026-104252 — critical · Go/vitess.io/vitess
• CVE-2026-107845 — critical · Packagist/contao/comments-bundle

Is your project exposed to this? Stateward checks every dependency on every pull request and flags it only if your code actually reaches it.

Summarize with AI

ChatGPTClaudePerplexity