CVE-2026-42211: high-severity vulnerability in remix-run react-router
React Router's vendored turbo-stream v2 allows arbitrary constructor invocation via TYPE_ERROR deserialization leading to Unauth RCE
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
21Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 8.1epss 0.4%
React Router is a router for React. In versions 7.0.0 through 7.14.1, when using Framework Mode, a combination of steps could potentially allow unauthorized remote code execution (RCE) through external requests. This attack requires the application code to have an existing prototype pollution vulnerability, which can then be leveraged in a 2-step attack where the second step triggers unauthorized RCE on the remote server. This does not impact applications using Declarative Mode (`<BrowserRouter>`) or Data Mode (`createBrowserRouter/<RouterProvider>`). This is patched in version 7.14.2.
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected products
remix-run · react-routerRelated CVEs — remix-run react-router
In the same product, most dangerous first.
CVE-2025-43864HIGHReact Router allows a DoS via cache poisoning by forcing SPA modeEPSS 20.5%CVE-2025-61686CRITICALReact Router has Path Traversal in File Session StorageEPSS 17.3%CVE-2025-31137HIGHRemix and React Router allow URL manipulation via Host / X-Forwarded-Host headersEPSS 1.2%CVE-2026-22029HIGHReact Router vulnerable to XSS via Open RedirectsEPSS 0.9%CVE-2025-43865HIGHReact Router allows pre-render data spoofing on React-Router framework modeEPSS 0.8%CVE-2026-55685HIGHReact Router: Unauthenticated Denial of Service via Inefficient Route MatchingEPSS 0.7%