CVE-2026-34077

React Router is a router for React. In versions 7.7.0 through 7.13.1, when using React Router's unstable React Server Components (RSC) APIs, there is a potential client-side Cross-Site Scripting (XSS) vulnerability in the RSC redirect handling if redirects come from untrusted sources. This does not impact applications that are not using the unstable RSC APIs in React Router. This is patched in version 7.13.2.

CVSS v3 7.5 HIGH

7.5^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://github.com/remix-run/react-router/security/advisories/GHSA-rxv8-25v2-qmq8	Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:shopify:react-router::::::node.js::*
	cpe:2.3:a:turbo-stream:turbo_stream::::::node.js::*

History

22 Jul 2026, 19:10

Type	Values Removed	Values Added
Summary		(es) React Router es un router para React. En las versiones 7.7.0 a la 7.13.1, al usar las API inestables de React Server Components (RSC) de React Router, existe una potencial vulnerabilidad de Cross-Site Scripting (XSS) del lado del cliente en el manejo de redirecciones de RSC si las redirecciones provienen de fuentes no confiables. Esto no tiene impacto en las aplicaciones que no están usando las API inestables de RSC en React Router. Esto está parcheado en la versión 7.13.2.

04 Jun 2026, 18:45

Type	Values Removed	Values Added
CPE		cpe:2.3:a:shopify:react-router::::::node.js::* cpe:2.3:a:turbo-stream:turbo_stream::::::node.js::*
First Time		Turbo-stream turbo Stream Shopify Turbo-stream Shopify react-router
References	~~() https://github.com/remix-run/react-router/security/advisories/GHSA-rxv8-25v2-qmq8 -~~	() https://github.com/remix-run/react-router/security/advisories/GHSA-rxv8-25v2-qmq8 - Vendor Advisory

02 Jun 2026, 20:16

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-06-02 20:16

Updated : 2026-07-22 19:10

NVD link : CVE-2026-34077

Mitre link : CVE-2026-34077

CVE.ORG link : CVE-2026-34077

JSON object : View

Products Affected

turbo-stream

turbo_stream

shopify

react-router

CWE

CWE-770

Allocation of Resources Without Limits or Throttling

{"id": "CVE-2026-34077", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-34077", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-06-03T13:18:47.056106Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 3.9}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "remix-run", "product": "react-router", "versions": [{"status": "affected", "version": ">= 7.0.0, < 7.14.0"}]}, {"vendor": "remix-run", "product": "turbo-stream", "versions": [{"status": "affected", "version": "< 3.0.0"}]}]}], "published": "2026-06-02T20:16:34.620", "references": [{"url": "https://github.com/remix-run/react-router/security/advisories/GHSA-rxv8-25v2-qmq8", "tags": ["Vendor Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-770"}]}], "descriptions": [{"lang": "en", "value": "React Router is a router for React. In versions 7.7.0 through 7.13.1, when using React Router's unstable React Server Components (RSC) APIs, there is a potential client-side Cross-Site Scripting (XSS) vulnerability in the RSC redirect handling if redirects come from untrusted sources. This does not impact applications that are not using the unstable RSC APIs in React Router. This is patched in version 7.13.2."}, {"lang": "es", "value": "React Router es un router para React. En las versiones 7.7.0 a la 7.13.1, al usar las API inestables de React Server Components (RSC) de React Router, existe una potencial vulnerabilidad de Cross-Site Scripting (XSS) del lado del cliente en el manejo de redirecciones de RSC si las redirecciones provienen de fuentes no confiables. Esto no tiene impacto en las aplicaciones que no est\u00e1n usando las API inestables de RSC en React Router. Esto est\u00e1 parcheado en la versi\u00f3n 7.13.2."}], "lastModified": "2026-07-22T19:10:00.120", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:shopify:react-router:*:*:*:*:*:node.js:*:*", "vulnerable": true, "matchCriteriaId": "2D9E0F51-1549-43BA-8554-E11FC5058DF5", "versionEndExcluding": "7.14.0", "versionStartIncluding": "7.0.0"}, {"criteria": "cpe:2.3:a:turbo-stream:turbo_stream:*:*:*:*:*:node.js:*:*", "vulnerable": true, "matchCriteriaId": "6A167D56-B10C-48C9-B077-3A8A6B8D71CF", "versionEndExcluding": "3.0.0"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}