Loading story…
Multiple vulnerabilities were disclosed in the widely used React Router npm package, including a reported remote code execution issue tracked as CVE-2026-42211 that researchers said could allow unauthenticated attackers to gain shell access when chained with an existing prototype pollution weakness. Additional flaws include CVE-2026-33245, a client-side cross-site scripting bug in redirect handling for applications using unstable React Server Components APIs, plus CVE-2026-34077 and CVE-2026-42342, two denial-of-service issues tied to serialization and manifest endpoint performance that can crash or degrade backend services.
The XSS issue affects React Router versions 7.7.0 through 7.13.1 when redirects originate from untrusted sources and use javascript: targets; applications not using the unstable RSC APIs or running in standard Declarative Mode are not impacted. Maintainers patched CVE-2026-33245 in React Router 7.13.2, while broader mitigation for the full set of reported issues requires upgrading to React Router 7.15.0 or Remix 2.17.5.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
4 events from the most recent confirmed update back to the earliest known activity.
Mitigations for the broader set of disclosed issues were made available by upgrading to React Router 7.15.0 or Remix 2.17.5. The update addressed the newly reported RCE, XSS, and DoS vulnerabilities.
Researchers reported multiple critical React Router vulnerabilities, including RCE flaw CVE-2026-42211, XSS flaw CVE-2026-33245, and DoS issues CVE-2026-34077 and CVE-2026-42342. The report said standard Declarative Mode was not affected.
React Router fixed CVE-2026-33245 in version 7.13.2. The vulnerability could be triggered through javascript: redirect targets from untrusted sources when applications used unstable RSC APIs.
The advisory for CVE-2026-33245 was received by security-advisories@github.com. The flaw is a client-side XSS issue in React Router's unstable React Server Components redirect handling affecting versions 7.7.0 through 7.13.1.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Multiple vulnerabilities have been identified in React Server Components (RSC), specifically CVE-2025-55183, CVE-2025-55184, and CVE-2025-67779, affecting several versions of `react-server-dom-webpack`, `react-server-dom-parcel`, and `react-server-dom-turbopack`. These vulnerabilities, discovered following the React2Shell incident, include a high-severity denial-of-service (DoS) flaw (CVE-2025-55184) caused by unsafe deserialization of structured input in the RSC Flight protocol, which can be exploited by sending specially crafted requests that trigger infinite loops or event-loop lockups on the server. The vulnerabilities also raise concerns about potential source code exposure and highlight the risk of residual flaws being discovered after major disclosures. The React Foundation has issued advisories and patches for affected versions, and the Canadian Centre for Cyber Security has urged administrators to update impacted libraries and frameworks, including popular tools such as Next.js, Vite RSC plugin, Parcel RSC plugin, React Router RSC preview, RedwoodSDK, and Waku. No public exploits are currently available, but the vulnerabilities have a higher-than-average likelihood of exploitation, emphasizing the importance of prompt remediation and ongoing vigilance for follow-on issues after initial vulnerability disclosures.
Jun 29, 2026
Vercel has released a broad set of security fixes for **Next.js** and related **React Server Components**, addressing more than a dozen vulnerabilities affecting App Router deployments across versions 13.x through 16.x and React Server Components 19.x. The disclosures include denial of service, server-side request forgery, cross-site scripting, cache poisoning, and multiple middleware authorization bypass conditions. Among the most serious issues is `CVE-2026-23870` (`GHSA-8h8q-6873-q5fj`), a high-severity denial-of-service flaw in React Flight deserialization that can be triggered through crafted requests to App Router Server Function endpoints, causing excessive CPU consumption; fixes were issued in Next.js `15.5.16` and `16.2.5`. Vercel also disclosed `CVE-2026-44578`, a high-severity SSRF issue in self-hosted Node.js deployments via crafted WebSocket upgrade requests.
Jun 29, 2026
A critical unauthenticated remote code execution flaw in React Server Components, tracked as **CVE-2025-55182** and widely dubbed **React2Shell**, exposed React 19 server-side packages and downstream frameworks including **Next.js App Router**. The bug stems from unsafe deserialization in the RSC/Flight protocol, allowing a single crafted HTTP request to reach vulnerable server function paths and execute arbitrary code in default deployments, including some apps that did not explicitly define Server Function endpoints. React released fixes for `react-server-dom-webpack`, `react-server-dom-parcel`, and `react-server-dom-turbopack` in **19.0.1**, **19.1.2**, and **19.2.1**, while Next.js issued related guidance under **CVE-2025-66478** for affected 15.x, 16.x, and certain canary releases; vendors stressed that WAF rules and hosting-provider mitigations are only temporary and that patching and redeployment are required. Security firms and vendors reported rapid weaponization after disclosure, with public exploit code, Nuclei and Metasploit support, and confirmed in-the-wild exploitation against internet-facing Next.js and other RSC-enabled applications. Reported post-compromise activity included **XMRig** cryptominers, **Sliver**, **MeshAgent**, **Cobalt Strike**, **SNOWLIGHT**, **ShadowPAD**, credential theft targeting cloud and Kubernetes environments, and persistence mechanisms tied to multiple China-linked actors and other threat groups; CISA added the flaw to its **Known Exploited Vulnerabilities** catalog. Researchers estimated broad exposure across cloud environments and web assets, while Cloudflare, Akamai, Imperva, Google Cloud, and others deployed emergency protections, underscoring the scale and urgency of remediation.
Aug 6, 2026