CVE-2026-34077
2 advisories.
npm/react-router CVE-2026-34077: high 7.5, EPSS 0.45%
React Router vulnerable to Denial of Service via reflected user input in single-fetch
Action: Upgrade react-router to 7.14.0 or later.
npm i react-router@7.14.0Affected
| introduced | fixed | last affected |
|---|---|---|
| 7.0.0 | 7.14.0 | - |
Fixed versions
| 7.14.0 |
Sources
- osv: GHSA-rxv8-25v2-qmq8
- https://github.com/remix-run/react-router/security/advisories/GHSA-rxv8-25v2-qmq8
- https://nvd.nist.gov/vuln/detail/CVE-2026-34077
- https://github.com/remix-run/react-router/commit/59811921d3c7d599077b8cadccdcd65a233165e0
- https://github.com/jacob-ebey/turbo-stream/blob/v2.4.1/src/flatten.ts#L175-L177
- https://github.com/jacob-ebey/turbo-stream/blob/v2.4.1/src/unflatten.ts#L185-L189
- https://github.com/remix-run/react-router
CVE-2026-34077 · published · modified · JSON
npm/turbo-stream CVE-2026-34077: high 7.5, EPSS 0.45%
React Router vulnerable to Denial of Service via reflected user input in single-fetch
Action: Upgrade turbo-stream to 3.0.0 or later.
npm i turbo-stream@3.0.0Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 3.0.0 | - |
Fixed versions
| 3.0.0 |
Sources
- osv: GHSA-rxv8-25v2-qmq8#npm/turbo-stream
- https://github.com/remix-run/react-router/security/advisories/GHSA-rxv8-25v2-qmq8
- https://nvd.nist.gov/vuln/detail/CVE-2026-34077
- https://github.com/remix-run/react-router/commit/59811921d3c7d599077b8cadccdcd65a233165e0
- https://github.com/jacob-ebey/turbo-stream/blob/v2.4.1/src/flatten.ts#L175-L177
- https://github.com/jacob-ebey/turbo-stream/blob/v2.4.1/src/unflatten.ts#L185-L189
- https://github.com/remix-run/react-router
CVE-2026-34077 · published · modified · JSON