CVE-2026-55685CWE-400CWE-407denial-of-service

CVE-2026-55685

High · published July 28, 2026

CVSS v3.1
7.5
EPSS
1%
Percentile
52.9
In the wild
Unconfirmed
What it is

React Router is a router for React. In versions 7.0.0 through 7.17.0, the manifest endpoint could be accessed via unauthenticated targeted requests that would put heavy load on the server and slow down response times. This issue is a follow up to CVE-2026-42342, and does not does not impact React Router applications using Declarative Mode (<BrowserRouter>) or Data Mode (createBrowserRouter/<RouterProvider>). This issue has been fixed in version 7.18.0.

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.00708 · 52.9th percentile
Weaknesses
CWE-400 · Uncontrolled Resource Consumption; CWE-407 · Inefficient Algorithmic Complexity
Published
2026-07-28T02:17Z
Affected products (1)
ProductVersionsFixed in
shopify/react-router≥ 7.0.0, < 7.18.07.18.0
References (6)
https://github.com/remix-run/react-router/blob/main/CHANGELOG.md#v7180 · [email protected]https://github.com/remix-run/react-router/commit/09e6020d1950e54f361f7ad00938ecd4dde60929 · [email protected]https://github.com/remix-run/react-router/pull/15186 · [email protected]https://github.com/remix-run/react-router/releases/tag/[email protected] · [email protected]https://github.com/remix-run/react-router/security/advisories/GHSA-8x6r-g9mw-2r78 · [email protected]https://github.com/remix-run/react-router/security/advisories/GHSA-chx6-hx7r-mcp5 · [email protected]
EPSS history
Timeline
  • 27 JUL 21:45Z
    React Router: Unauthenticated Denial of Service via Inefficient Route Matching
    cvelistv5