CVE-2026-40181CWE-601

CVE-2026-40181

Medium · published June 3, 2026

CVSS v3.1
6.1
EPSS
0%
Percentile
12.0
In the wild
Unconfirmed
What it is

React Router is a router for React. In versions 7.0.0 through 7.14.0 and 6.7.0 through 6.30.3, certain URLs passed to the redirect function can trigger an open redirect to an external domain due to path values starting with // being reinterpreted as protocol-relative URLs. The level of impact depends on the validation done by the application prior to returning the redirect. This does not impact applications using Declarative Mode (<BrowserRouter>). This is patched in versions 7.14.1 and 6.30.4.

The record
Technical detail
CVSS v3.1
6.1 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00221 · 12.0th percentile
Weakness
CWE-601 · URL Redirection to Untrusted Site ('Open Redirect')
Published
2026-06-03T00:16Z
Affected products (2)
ProductVersionsFixed in
shopify/react-router≥ 6.7.0, < 6.30.46.30.4
shopify/react-router≥ 7.0.0, < 7.14.17.14.1
References (1)
https://github.com/remix-run/react-router/security/advisories/GHSA-2j2x-hqr9-3h42 · [email protected]
EPSS history
Timeline
  • 02 JUN 17:55Z
    React Router's same-origin redirect with path starting // causes open redirect via protocol-relative URL reinterpretation
    cvelistv5