CVE-2026-42342: React Router vulnerable to DoS via unbounded path expansion in __manifest endpoint
React Router is a router for React. In versions 7.0.0 through 7.14.x of react-router and versions 2.10.0 through 2.17.4 of @remix-run/server-runtime, certain crafted requests can consume disproportionate server resources via unbounded path expansion in the manifest endpoint, resulting in response time degradation and/or service unavailability for end users. This affects React Router Framework Mode applications as well as Remix applications. This does not impact applications using Declarative Mode (<BrowserRouter>) or Data Mode (createBrowserRouter/<RouterProvider>). This is patched in react-router version 7.15.0 and @remix-run/server-runtime version 2.17.5.
Other sources
React Router is a router for React. In versions 7.0.0 through 7.14.x of react-router and versions 2.10.0 through 2.17.4 of @remix-run/server-runtime, certain crafted requests can consume disproportionate server resources via unbounded path expansion in the manifest endpoint, resulting in response time degradation and/or service unavailability for end users. This affects React Router Framework Mode applications as well as Remix applications. This does not impact applications using Declarative Mode (BrowserRouter) or Data Mode (createBrowserRouter/RouterProvider). This is patched in react-router version 7.15.0 and @remix-run/server-runtime version 2.17.5.
— IBM
There exists a potential DOS attack vector in React Router Framework Mode applications (as well as Remix v2.10.0 - 2.17.4). Certain requests can be crafted to consume disproportionate resources on the server, resulting in response time degredation and/or service unavailability for end users.
> [!NOTE] > This does not impact your React Router application if you are using Declarative Mode (<BrowserRouter>) or Data Mode (createBrowserRouter/<RouterProvider>).
— GitHub
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
npm/@remix-run/server-runtimeto a version that resolves this vulnerability.Fixed in 2.17.5 - Upgrade
Upgrade
npm/react-routerto a version that resolves this vulnerability.Fixed in 7.15.0 - Upgrade
Upgrade
react-routerto a version that resolves this vulnerability.Fixed in 7.15.0 - Upgrade
Upgrade
@remix-run/server-runtimeto a version that resolves this vulnerability.Fixed in 2.17.5 - Compensating control
If you are using React Router Framework Mode (or Remix applications), ensure the application is not exposed in a way that allows crafted requests to target the __manifest endpoint until the upgrades to react-router 7.15.0 and @remix-run/server-runtime 2.17.5 are applied (this issue does not impact Declarative Mode <BrowserRouter> or Data Mode createBrowserRouter/<RouterProvider>).
Event History
Frequently Asked Questions
What is the severity of CVE-2026-42342?
CVE-2026-42342 has a high severity rating of 7.5.
How do I fix CVE-2026-42342?
To mitigate CVE-2026-42342, it is recommended to upgrade to versions of react-router beyond 7.14.x and @remix-run/server-runtime beyond 2.17.4.
What type of vulnerability is CVE-2026-42342?
CVE-2026-42342 is classified as a denial of service (DoS) vulnerability due to unbounded path expansion in the __manifest endpoint.
Which software is affected by CVE-2026-42342?
CVE-2026-42342 affects versions 7.0.0 through 7.14.x of react-router and versions 2.10.0 through 2.17.4 of @remix-run/server-runtime.
What impact can CVE-2026-42342 have on my application?
CVE-2026-42342 can lead to significant server resource consumption, potentially bringing down services through crafted requests.