CVE-2026-55685 in React Router
Summary
by MITRE • 07/28/2026
React Router is a router for React. In versions 7.0.0 through 7.17.0, the manifest endpoint could be accessed via unauthenticated targeted requests that would put heavy load on the server and slow down response times. This issue is a follow up to CVE-2026-42342, and does not does not impact React Router applications using Declarative Mode (<BrowserRouter>) or Data Mode (createBrowserRouter/<RouterProvider>). This issue has been fixed in version 7.18.0.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 07/28/2026
This vulnerability affects React Router versions 7.0.0 through 7.17.0 and represents a significant denial of service condition that could severely impact server performance and application availability. The flaw specifically involves the manifest endpoint which becomes accessible through unauthenticated targeted requests, allowing malicious actors to exploit this weakness for resource exhaustion attacks. The vulnerability operates by leveraging the router's handling of manifest requests without proper authentication checks, creating an entry point for attackers to generate excessive load against the server infrastructure.
The technical implementation of this vulnerability stems from improper access control mechanisms within the React Router framework's manifest endpoint handling. When unauthenticated requests are made to the manifest endpoint, the system fails to implement adequate rate limiting or authentication requirements that would normally prevent such resource-intensive operations. This design flaw creates a pathway for attackers to continuously submit requests that consume significant server resources, leading to degraded performance and potential service disruption. The vulnerability is particularly concerning because it affects applications that utilize the traditional imperative routing mode rather than the newer declarative approaches.
The operational impact of this vulnerability extends beyond simple performance degradation to potentially compromising the entire application availability. Servers under attack experience increased CPU utilization, memory consumption, and network bandwidth usage as malicious requests flood the manifest endpoint. This resource exhaustion can cause legitimate users to experience slow response times or complete service unavailability, effectively creating a denial of service condition that undermines the application's reliability and user experience. The vulnerability affects specific routing patterns in React applications that rely on the older imperative approach rather than modern declarative modes.
This issue represents a follow-up to CVE-2026-42342 and demonstrates the ongoing challenges in securing web routing frameworks against resource exhaustion attacks. The vulnerability has been classified under CWE-307 which specifically addresses improper restriction of excessive authentication attempts, though in this case the issue manifests as resource consumption rather than credential brute force. From an attack perspective, this vulnerability aligns with techniques described in the MITRE ATT&CK framework under the denial of service category, specifically targeting application availability through resource exhaustion. The fix implemented in React Router version 7.18.0 addresses the core authentication bypass issue by introducing proper access controls and rate limiting mechanisms for manifest endpoint requests.
Organizations using affected React Router versions should immediately upgrade to version 7.18.0 or later to remediate this vulnerability, as no workarounds are available that would maintain full functionality while addressing the underlying security flaw. The mitigation strategy focuses on ensuring that all manifest endpoint access is properly authenticated and rate-limited, preventing unauthorized users from consuming excessive server resources through targeted requests. Applications that have already transitioned to Declarative Mode or Data Mode are unaffected by this specific vulnerability, though administrators should still verify their overall application security posture remains intact. The resolution demonstrates the importance of continuous security monitoring and timely patch management in maintaining robust web application defenses against evolving threat vectors.