npm/react-router CVE-2026-53668: medium 6.9, EPSS 0.34%

React Router: Open redirect leading to XSS

Action: Upgrade react-router to 7.13.0 or later.

npm i react-router@7.13.0

Affected

Fixed versions

Sources

• osv: GHSA-jjmj-jmhj-qwj2#npm/react-router
• https://github.com/remix-run/react-router/security/advisories/GHSA-jjmj-jmhj-qwj2
• https://nvd.nist.gov/vuln/detail/CVE-2026-53668
• https://github.com/remix-run/react-router/pull/14718
• https://github.com/remix-run/react-router/commit/3a5b5ad0e5cf9918c646509563f5c41a89226ff3
• https://github.com/remix-run/react-router
• https://github.com/remix-run/react-router/blob/main/CHANGELOG.md#v7180
• https://github.com/remix-run/react-router/blob/v6/CHANGELOG.md#v6306
• https://github.com/remix-run/react-router/releases/tag/react-router@6.30.6
• https://github.com/remix-run/react-router/releases/tag/react-router@7.18.0

CVE-2026-53668 · published 2026-07-23T19:36:31Z · modified 2026-09-08T15:15:05.351463216Z · JSON