CVE-2026-53667 in react-router
Summary
by MITRE • 07/28/2026
React Router is a router for React. In versions 7.11.0 through 7.17.0, the RSCErrorHandler is missing protocol validation, allowing for redirects from untrusted sources. This issue is a follow up to CVE-2026-53667, and only affects consuming applications if they are using the unstable RSC APIs. This issue has been fixed in version 7.18.0.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 07/28/2026
The vulnerability in React Router versions 7.11.0 through 7.17.0 represents a critical security flaw within the RSCErrorHandler component that lacks proper protocol validation for redirect operations. This weakness specifically targets applications utilizing the unstable React Server Components APIs, creating an attack surface where malicious actors can manipulate redirect behavior through untrusted sources. The issue serves as a follow-up to CVE-2026-53667, indicating a continuation of security concerns within the React Router framework's handling of server-side rendering components. The vulnerability manifests when applications process redirects without validating the protocols of source URLs, potentially allowing attackers to redirect users to malicious domains or internal network resources that would otherwise be restricted.
The technical implementation flaw resides in the RSCErrorHandler's insufficient validation mechanisms that fail to properly sanitize or verify protocol schemes during redirect operations. This allows for potential protocol confusion attacks where attackers can exploit the lack of validation to manipulate redirect destinations, particularly when dealing with protocols such as http, https, ftp, or other custom schemes. The vulnerability specifically impacts applications that have opted into using unstable RSC APIs, making it a targeted issue rather than a broad security concern affecting all React Router installations. According to CWE classification, this vulnerability aligns with CWE-601 URL Redirection to Untrusted Site ('Open Redirect') which is categorized under the broader category of injection vulnerabilities and falls within the ATT&CK framework's T1566.002 technique for Phishing via Social Media.
The operational impact of this vulnerability extends beyond simple redirect manipulation, as it can enable more sophisticated attack vectors including phishing campaigns, credential theft attempts, and potential lateral movement within network environments. Applications that rely on user-provided URLs or external data sources for redirect operations become particularly vulnerable, as attackers can craft malicious URLs that bypass normal security controls. The risk is amplified in enterprise environments where internal resources might be accessible through redirects, potentially allowing attackers to access restricted systems or data. This vulnerability demonstrates the importance of input validation and protocol sanitization in web applications, especially when dealing with unstable features that may not undergo the same level of security scrutiny as stable APIs.
Organizations utilizing React Router versions within the affected range must implement immediate mitigations to protect their applications from potential exploitation. The most effective solution involves upgrading to React Router version 7.18.0 or later, which includes the necessary protocol validation fixes within the RSCErrorHandler component. Additionally, application developers should conduct thorough code reviews to identify any custom implementations that might be using the unstable RSC APIs and ensure proper input sanitization is implemented at all redirect points. Security teams should monitor for potential exploitation attempts through network traffic analysis and implement web application firewalls with protocol validation capabilities to detect and block suspicious redirect patterns. The vulnerability highlights the critical need for maintaining up-to-date dependencies and implementing robust security controls around any unstable or experimental API features that applications might utilize.