CVE-2026-42211: React Router's vendored turbo-stream v2 allows arbitrary constructor invocation via TYPE_ERROR deserialization leading to Unauth RCE
React Router is a router for React. In versions 7.0.0 through 7.14.1, when using Framework Mode, a combination of steps could potentially allow unauthorized remote code execution (RCE) through external requests. This attack requires the application code to have an existing prototype pollution vulnerability, which can then be leveraged in a 2-step attack where the second step triggers unauthorized RCE on the remote server. This does not impact applications using Declarative Mode (<BrowserRouter>) or Data Mode (createBrowserRouter/<RouterProvider>). This is patched in version 7.14.2.
Other sources
React Router is a router for React. In versions 7.0.0 through 7.14.1, when using Framework Mode, a combination of steps could potentially allow unauthorized remote code execution (RCE) through external requests. This attack requires the application code to have an existing prototype pollution vulnerability, which can then be leveraged in a 2-step attack where the second step triggers unauthorized RCE on the remote server. This does not impact applications using Declarative Mode (BrowserRouter) or Data Mode (createBrowserRouter/RouterProvider). This is patched in version 7.14.2.
— IBM
When using React Router v7 in Framework Mode, there exists a combination of steps that could potentially allow unauthorized RCE through external requests. This first requires the application code to have an existing prototype pollution vulnerability. This can be leveraged into a 2-step attack in which the second step can trigger unauthorized RCE on the remote server.
> [!NOTE] > This does not impact your React Router application if you are using Declarative Mode (<BrowserRouter>) or Data Mode (createBrowserRouter/<RouterProvider>).
— GitHub
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
npm/react-routerto a version that resolves this vulnerability.Fixed in 7.14.2 - Upgrade
Upgrade
React Routerto a version that resolves this vulnerability.Fixed in 7.14.2
Event History
Frequently Asked Questions
What is the severity of CVE-2026-42211?
The severity of CVE-2026-42211 is high with a score of 8.1.
What are the potential risks associated with CVE-2026-42211?
CVE-2026-42211 can lead to unauthorized remote code execution (RCE) through prototype pollution.
How do I fix CVE-2026-42211?
To fix CVE-2026-42211, update React Router to versions later than 7.14.1 that address this vulnerability.
Which versions of React Router are affected by CVE-2026-42211?
CVE-2026-42211 affects React Router versions from 7.0.0 through 7.14.1.
Can CVE-2026-42211 be exploited without authentication?
Yes, CVE-2026-42211 can be exploited without authentication, making it particularly dangerous.