Exposição de React Router

JavaScript frameworks
114
score de exposição
181.374
sites usam
1
em exploração
2
críticos
Análise Vexday

Com 18 CVEs catalogadas e 9 surgidas nos últimos 90 dias, o React Router apresenta um ritmo recente de descoberta de vulnerabilidades que merece atenção contínua. A taxa de exploração ativa — 5,56% das CVEs presentes no catálogo CISA KEV — está 12,4 vezes acima da média geral do catálogo, o que indica que a biblioteca atrai interesse real de atores maliciosos, não apenas pesquisadores. O tipo de falha mais comum é CWE-79 (Cross-Site Scripting), sugerindo lacunas persistentes no tratamento de saída e sanitização de dados em aplicações que dependem da biblioteca. A CVE mais perigosa atualmente ativa, CVE-2026-45321, registra EPSS de 0,023, sinalizando probabilidade ainda moderada de exploração ampla no curto prazo, mas o histórico da tecnologia recomenda monitoramento ativo e aplicação prioritária de correções disponíveis.

CVEs

23 resultados
CVE-2026-45321CRITICALMalware in 42 @tanstack/* packages exfiltrates cloud credentials, GitHub tokens, and SSH keysEPSS 2.3%KEVCVE-2025-43864HIGHReact Router allows a DoS via cache poisoning by forcing SPA modeEPSS 20.2%CVE-2025-61686CRITICALReact Router has Path Traversal in File Session StorageEPSS 15.9%CVE-2025-31137HIGHRemix and React Router allow URL manipulation via Host / X-Forwarded-Host headersEPSS 1.2%CVE-2025-43865HIGHReact Router allows pre-render data spoofing on React-Router framework modeEPSS 0.8%CVE-2026-22029HIGHReact Router vulnerable to XSS via Open RedirectsEPSS 0.8%CVE-2026-55685HIGHReact Router: Unauthenticated Denial of Service via Inefficient Route MatchingEPSS 0.7%CVE-2026-21884HIGHReact Router SSR XSS in ScrollRestorationEPSS 0.5%CVE-2025-59057HIGHReact Router has XSS VulnerabilityEPSS 0.4%CVE-2026-42211HIGHReact Router's vendored turbo-stream v2 allows arbitrary constructor invocation via TYPE_ERROR deserialization leading to Unauth RCEEPSS 0.4%CVE-2026-53666MEDIUMReact Router: Arbitrary Constructor Injection via deserializeErrors() in React Router SSR HydrationEPSS 0.4%CVE-2026-53667MEDIUMReact Router: Cross-site Scripting is Possible due to Missing RSCErrorHandler Protocol Validation (Incomplete fix for CVE-2026-53667)EPSS 0.4%CVE-2026-53668MEDIUMReact Router: Open redirect can lead to XSSEPSS 0.3%CVE-2026-53669MEDIUMReact Router: Open redirect via backslash in <Link> and useNavigate (CVE-2025-68470 bypass)EPSS 0.3%CVE-2026-42342HIGHReact Router vulnerable to DoS via unbounded path expansion in __manifest endpointEPSS 0.3%CVE-2026-34077HIGHReact Router vulnerable to Denial of Service via reflected user input in single-fetchEPSS 0.3%CVE-2026-42349HIGHClerk: Authorization bypass when combining organization, billing, or reverification checksEPSS 0.2%CVE-2025-68470MEDIUMReact Router has unexpected external redirect via untrusted pathsEPSS 0.2%CVE-2026-33245HIGHReact Router vulnerable to XSS in unstable RSC redirect handling via javascript: redirect targetsEPSS 0.2%CVE-2026-40181MEDIUMReact Router's same-origin redirect with path starting // causes open redirect via protocol-relative URL reinterpretationEPSS 0.2%