React Router is a router for React. In versions 7.0.0 through 7.14.x of react-router and versions 2.10.0 through 2.17.4 of @remix-run/server-runtime, certain crafted requests can consume disproportionate server resources via unbounded path expansion in the __manifest endpoint, resulting in response time degradation and/or service unavailability for end users. This affects React Router Framework Mode applications as well as Remix applications. This does not impact applications using Declarative Mode (`<BrowserRouter>`) or Data Mode (`createBrowserRouter/<RouterProvider>`). This is patched in react-router version 7.15.0 and @remix-run/server-runtime version 2.17.5.
References
| Link | Resource |
|---|---|
| https://github.com/remix-run/react-router/security/advisories/GHSA-8x6r-g9mw-2r78 | Vendor Advisory |
Configurations
Configuration 1 (hide)
|
History
04 Jun 2026, 19:00
| Type | Values Removed | Values Added |
|---|---|---|
| CPE | cpe:2.3:a:shopify:remix-run\/server-runtime:*:*:*:*:*:node.js:*:* cpe:2.3:a:shopify:react-router:*:*:*:*:*:node.js:*:* |
|
| References | () https://github.com/remix-run/react-router/security/advisories/GHSA-8x6r-g9mw-2r78 - Vendor Advisory | |
| First Time |
Shopify
Shopify react-router Shopify remix-run\/server-runtime |
02 Jun 2026, 20:16
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2026-06-02 20:16
Updated : 2026-06-04 19:00
NVD link : CVE-2026-42342
Mitre link : CVE-2026-42342
CVE.ORG link : CVE-2026-42342
JSON object : View
Products Affected
shopify
- remix-run\/server-runtime
- react-router
CWE
CWE-400
Uncontrolled Resource Consumption