CVE-2026-22029

React Router is a router for React. In @remix-run/router version prior to 1.23.2 and react-router 7.0.0 through 7.11.0, React Router (and Remix v1/v2) SPA open navigation redirects originating from loaders or actions in Framework Mode, Data Mode, or the unstable RSC modes can result in unsafe URLs causing unintended javascript execution on the client. This is only an issue if you are creating redirect paths from untrusted content or via an open redirect. There is no impact if Declarative Mode (<BrowserRouter>) is being used. This issue has been patched in @remix-run/router version 1.23.2 and react-router version 7.12.0.
References
Link Resource
https://github.com/remix-run/react-router/security/advisories/GHSA-2w69-qvjg-hvjx Vendor Advisory
https://access.redhat.com/errata/RHSA-2026:13542
https://access.redhat.com/errata/RHSA-2026:13548
https://access.redhat.com/errata/RHSA-2026:1517
https://access.redhat.com/errata/RHSA-2026:17468
https://access.redhat.com/errata/RHSA-2026:17469
https://access.redhat.com/errata/RHSA-2026:17474
https://access.redhat.com/errata/RHSA-2026:19712
https://access.redhat.com/errata/RHSA-2026:20041
https://access.redhat.com/errata/RHSA-2026:20042
https://access.redhat.com/errata/RHSA-2026:2147
https://access.redhat.com/errata/RHSA-2026:2148
https://access.redhat.com/errata/RHSA-2026:2149
https://access.redhat.com/errata/RHSA-2026:21658
https://access.redhat.com/errata/RHSA-2026:2350
https://access.redhat.com/errata/RHSA-2026:2456
https://access.redhat.com/errata/RHSA-2026:2568
https://access.redhat.com/errata/RHSA-2026:2572
https://access.redhat.com/errata/RHSA-2026:26413
https://access.redhat.com/errata/RHSA-2026:26420
https://access.redhat.com/errata/RHSA-2026:2694
https://access.redhat.com/errata/RHSA-2026:3087
https://access.redhat.com/errata/RHSA-2026:34100
https://access.redhat.com/errata/RHSA-2026:36651
https://access.redhat.com/errata/RHSA-2026:36882
https://access.redhat.com/errata/RHSA-2026:3782
https://access.redhat.com/errata/RHSA-2026:3958
https://access.redhat.com/errata/RHSA-2026:3959
https://access.redhat.com/errata/RHSA-2026:3960
https://access.redhat.com/errata/RHSA-2026:40118
https://access.redhat.com/errata/RHSA-2026:40945
https://access.redhat.com/errata/RHSA-2026:40984
https://access.redhat.com/errata/RHSA-2026:41064
https://access.redhat.com/errata/RHSA-2026:41928
https://access.redhat.com/errata/RHSA-2026:5633
https://access.redhat.com/errata/RHSA-2026:5636
https://access.redhat.com/errata/RHSA-2026:8218
https://access.redhat.com/errata/RHSA-2026:8229
https://access.redhat.com/errata/RHSA-2026:9848
https://access.redhat.com/security/cve/CVE-2026-22029
https://bugzilla.redhat.com/show_bug.cgi?id=2428412
https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-22029.json
Configurations

Configuration 1 (hide)

cpe:2.3:a:shopify:remix-run\/react:*:*:*:*:*:node.js:*:*

Configuration 2 (hide)

cpe:2.3:a:shopify:react-router:*:*:*:*:*:node.js:*:*

History

21 Jul 2026, 12:17

Type Values Removed Values Added
References
  • () https://access.redhat.com/errata/RHSA-2026:41928 -

20 Jul 2026, 12:18

Type Values Removed Values Added
References
  • {'url': 'https://access.redhat.com/errata/RHSA-2026:40138', 'source': '0b0ca135-0b70-47e7-9f44-1890c2a1c46c'}
  • () https://access.redhat.com/errata/RHSA-2026:41064 -

17 Jul 2026, 13:17

Type Values Removed Values Added
References
  • () https://access.redhat.com/errata/RHSA-2026:40945 -

16 Jul 2026, 12:17

Type Values Removed Values Added
References
  • () https://access.redhat.com/errata/RHSA-2026:40118 -
  • () https://access.redhat.com/errata/RHSA-2026:40138 -
  • () https://access.redhat.com/errata/RHSA-2026:40984 -

10 Jul 2026, 12:16

Type Values Removed Values Added
References
  • () https://access.redhat.com/errata/RHSA-2026:34100 -

09 Jul 2026, 13:16

Type Values Removed Values Added
References
  • () https://access.redhat.com/errata/RHSA-2026:36651 -
  • () https://access.redhat.com/errata/RHSA-2026:36882 -

30 Jun 2026, 03:17

Type Values Removed Values Added
References
  • () https://access.redhat.com/errata/RHSA-2026:13542 -
  • () https://access.redhat.com/errata/RHSA-2026:13548 -
  • () https://access.redhat.com/errata/RHSA-2026:1517 -
  • () https://access.redhat.com/errata/RHSA-2026:17468 -
  • () https://access.redhat.com/errata/RHSA-2026:17469 -
  • () https://access.redhat.com/errata/RHSA-2026:17474 -
  • () https://access.redhat.com/errata/RHSA-2026:19712 -
  • () https://access.redhat.com/errata/RHSA-2026:20041 -
  • () https://access.redhat.com/errata/RHSA-2026:20042 -
  • () https://access.redhat.com/errata/RHSA-2026:2147 -
  • () https://access.redhat.com/errata/RHSA-2026:2148 -
  • () https://access.redhat.com/errata/RHSA-2026:2149 -
  • () https://access.redhat.com/errata/RHSA-2026:21658 -
  • () https://access.redhat.com/errata/RHSA-2026:2350 -
  • () https://access.redhat.com/errata/RHSA-2026:2456 -
  • () https://access.redhat.com/errata/RHSA-2026:2568 -
  • () https://access.redhat.com/errata/RHSA-2026:2572 -
  • () https://access.redhat.com/errata/RHSA-2026:26413 -
  • () https://access.redhat.com/errata/RHSA-2026:26420 -
  • () https://access.redhat.com/errata/RHSA-2026:2694 -
  • () https://access.redhat.com/errata/RHSA-2026:3087 -
  • () https://access.redhat.com/errata/RHSA-2026:3782 -
  • () https://access.redhat.com/errata/RHSA-2026:3958 -
  • () https://access.redhat.com/errata/RHSA-2026:3959 -
  • () https://access.redhat.com/errata/RHSA-2026:3960 -
  • () https://access.redhat.com/errata/RHSA-2026:5633 -
  • () https://access.redhat.com/errata/RHSA-2026:5636 -
  • () https://access.redhat.com/errata/RHSA-2026:8218 -
  • () https://access.redhat.com/errata/RHSA-2026:8229 -
  • () https://access.redhat.com/errata/RHSA-2026:9848 -
  • () https://access.redhat.com/security/cve/CVE-2026-22029 -
  • () https://bugzilla.redhat.com/show_bug.cgi?id=2428412 -
  • () https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-22029.json -

02 Jun 2026, 17:16

Type Values Removed Values Added
Summary
  • (es) React Router es un router para React. En las versiones de @remix-run/router anteriores a la 1.23.2 y de react-router de la 7.0.0 a la 7.11.0, las redirecciones de navegación abierta de SPA de React Router (y Remix v1/v2) que se originan en cargadores o acciones en el Modo Framework, Modo Datos, o los modos RSC inestables pueden resultar en URLs inseguras que causan la ejecución no intencionada de javascript en el cliente. Esto es solo un problema si se están creando rutas de redirección a partir de contenido no confiable o a través de una redirección abierta. No hay impacto si se está utilizando el Modo Declarativo (). Este problema ha sido parcheado en la versión 1.23.2 de @remix-run/router y la versión 7.12.0 de react-router.
Summary (en) React Router is a router for React. In @remix-run/router version prior to 1.23.2. and react-router 7.0.0 through 7.11.0, React Router (and Remix v1/v2) SPA open navigation redirects originating from loaders or actions in Framework Mode, Data Mode, or the unstable RSC modes can result in unsafe URLs causing unintended javascript execution on the client. This is only an issue if you are creating redirect paths from untrusted content or via an open redirect. There is no impact if Declarative Mode (<BrowserRouter>) is being used. This issue has been patched in @remix-run/router version 1.23.2 and react-router version 7.12.0. (en) React Router is a router for React. In @remix-run/router version prior to 1.23.2 and react-router 7.0.0 through 7.11.0, React Router (and Remix v1/v2) SPA open navigation redirects originating from loaders or actions in Framework Mode, Data Mode, or the unstable RSC modes can result in unsafe URLs causing unintended javascript execution on the client. This is only an issue if you are creating redirect paths from untrusted content or via an open redirect. There is no impact if Declarative Mode (<BrowserRouter>) is being used. This issue has been patched in @remix-run/router version 1.23.2 and react-router version 7.12.0.

10 Feb 2026, 19:36

Type Values Removed Values Added
References () https://github.com/remix-run/react-router/security/advisories/GHSA-2w69-qvjg-hvjx - () https://github.com/remix-run/react-router/security/advisories/GHSA-2w69-qvjg-hvjx - Vendor Advisory
CPE cpe:2.3:a:shopify:react-router:*:*:*:*:*:node.js:*:*
cpe:2.3:a:shopify:remix-run\/react:*:*:*:*:*:node.js:*:*
First Time Shopify
Shopify react-router
Shopify remix-run\/react

10 Jan 2026, 03:15

Type Values Removed Values Added
New CVE

Information

Published : 2026-01-10 03:15

Updated : 2026-07-21 12:17


NVD link : CVE-2026-22029

Mitre link : CVE-2026-22029

CVE.ORG link : CVE-2026-22029


JSON object : View

Products Affected

shopify

  • react-router
  • remix-run\/react
CWE
CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')