{"action":"Upgrade react-router to 7.18.0 or later.","affected":[{"fixed":"7.18.0","introduced":"7.0.0"}],"component":"react-router","cve_ids":["CVE-2026-55685"],"ecosystem":"npm","epss":0.00708,"exploited":false,"fixed_versions":["7.18.0"],"ghsa_id":"GHSA-chx6-hx7r-mcp5","id":"tcs_01M5KFJY8H6WS70JRPQTS6Z6P9","modified_at":"2026-09-10T03:51:11.397587276Z","published_at":"2026-07-24T14:06:57Z","references":["https://osv.dev/vulnerability/GHSA-chx6-hx7r-mcp5","https://github.com/remix-run/react-router/security/advisories/GHSA-chx6-hx7r-mcp5","https://github.com/remix-run/react-router/pull/15186","https://github.com/remix-run/react-router/commit/09e6020d1950e54f361f7ad00938ecd4dde60929","https://github.com/remix-run/react-router","https://github.com/remix-run/react-router/blob/main/CHANGELOG.md#v7180","https://github.com/remix-run/react-router/releases/tag/react-router@7.18.0"],"severity":{"label":"high"},"sources":[{"source":"osv","source_id":"GHSA-chx6-hx7r-mcp5","url":"https://osv.dev/vulnerability/GHSA-chx6-hx7r-mcp5"}],"summary":"React Router: Unauthenticated Denial of Service via Inefficient Route Matching"}