React Router vulnerable to DoS via unbounded path expansion in __manifest endpoint
Priority LOW 39CWE-400Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Denial of service
- Confidentiality · integrity · availability
- None · None · High
- Fix status
- Partial Red Hat: 7 fixed, 36 without a fix
Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-400.
Summary
React Router is a router for React. In versions 7.0.0 through 7.14.x of react-router and versions 2.10.0 through 2.17.4 of @remix-run/server-runtime, certain crafted requests can consume disproportionate server resources via unbounded path expansion in the __manifest endpoint, resulting in response time degradation and/or service unavailability for end users. This affects React Router Framework Mode applications as well as Remix applications. This does not impact applications using Declarative Mode (`<BrowserRouter>`) or Data Mode (`createBrowserRouter/<RouterProvider>`). This is patched in react-router version 7.15.0 and @remix-run/server-runtime version 2.17.5.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00299 22nd percentileScored 2026-11-07
Fix Partial react-router (remix-run): 7.15.0@remix-run/server-runtime (remix-run): 2.17.5+2 more productsRed Hat: 7 advisoriesRed Hat: 7 fixed, 36 without a fix
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| remix-run | react-router | 7.0.0 to before 7.15.0 | 7.15.0 | Patch available | CNA |
| remix-run | @remix-run/server-runtime | 2.10.0 to before 2.17.5 | 2.17.5 | Patch available | CNA |
| — | react-router (npm) | 7.0.0 to before 7.15.0 | 7.15.0 | Patch available | GHSA-8x6r-g9mw-2r78 |
| — | @remix-run/server-runtime (npm) | 2.10.0 to before 2.17.5 | 2.17.5 | Patch available | GHSA-8x6r-g9mw-2r78 |
- react-router Vendorremix-run Affected 7.0.0 to before 7.15.0 Fixed in 7.15.0 Patch available CNA
- @remix-run/server-runtime Vendorremix-run Affected 2.10.0 to before 2.17.5 Fixed in 2.17.5 Patch available CNA
- react-router (npm) Vendor— Affected 7.0.0 to before 7.15.0 Fixed in 7.15.0 Patch available GHSA-8x6r-g9mw-2r78
- @remix-run/server-runtime (npm) Vendor— Affected 2.10.0 to before 2.17.5 Fixed in 2.17.5 Patch available GHSA-8x6r-g9mw-2r78
Remediation
- Fix · CNA react-router (remix-run) Fixed in 7.15.0
- Fix · CNA @remix-run/server-runtime (remix-run) Fixed in 2.17.5
- Fix · GHSA-8x6r-g9mw-2r78 react-router (npm) Fixed in 7.15.0 Advisory →
- Fix · GHSA-8x6r-g9mw-2r78 @remix-run/server-runtime (npm) Fixed in 2.17.5 Advisory →
Red Hat 7 advisories
- RHSA-2026:60520 Released 2026-08-27 · Red Hat rating CriticalRHOAI 3.4.4 - Red Hat OpenShift AI
- Red Hat OpenShift AI 3.4 registry.redhat.io/rhoai/odh-automl-rhel9, registry.redhat.io/rhoai/odh-autorag-rhel9, registry.redhat.io/rhoai/odh-built-in-detector-rhel9 +47
- RHSA-2026:56431 Released 2026-08-18 · Red Hat rating ImportantRed Hat OpenShift Data Foundation 4.18.27 security, enhancement & bug fix update
- Red Hat Openshift Data Foundation 4.18 registry.redhat.io/odf4/cephcsi-rhel9, registry.redhat.io/odf4/cephcsi-rhel9-operator, registry.redhat.io/odf4/mcg-core-rhel9 +16
- RHSA-2026:56366 Released 2026-08-18 · Red Hat rating ImportantRed Hat OpenShift Data Foundation 4.19.22 security, enhancement & bug fix update
- Red Hat Openshift Data Foundation 4.19 registry.redhat.io/odf4/cephcsi-rhel9, registry.redhat.io/odf4/cephcsi-rhel9-operator, registry.redhat.io/odf4/mcg-core-rhel9 +17
Show 4 more Red Hat advisories
- RHSA-2026:50300 Released 2026-08-04 · Red Hat rating ImportantMigration Toolkit for Applications
- Red Hat Migration Toolkit for Applications 8.1 registry.redhat.io/mta/mta-cli-rhel9, registry.redhat.io/mta/mta-ui-rhel9
- RHSA-2026:48124 Released 2026-07-29 · Red Hat rating ImportantRed Hat OpenShift Dev Spaces 3.29.1 Release.
- Red Hat OpenShift Dev Spaces 3.29 registry.redhat.io/devspaces/code-rhel9, registry.redhat.io/devspaces/dashboard-rhel9, registry.redhat.io/devspaces/jetbrains-ide-rhel9 +2
- RHSA-2026:42085 Released 2026-07-20 · Red Hat rating ImportantRHTAS 1.3.6 - Red Hat Trusted Artifact Signer Release
- Red Hat Trusted Artifact Signer 1.3 registry.redhat.io/rhtas/rhtas-console-ui-rhel9
- RHSA-2026:41951 Released 2026-07-20 · Red Hat rating ImportantRed Hat Data Grid 8.6.2 security update
- Red Hat Data Grid 8.6.2
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Exploit Intelligence | Affected | No fix yet |
| Gatekeeper 3 | Affected | No fix yet: Fix deferred |
| Migration Toolkit for Containers | Affected | No fix yet |
| Migration Toolkit for Virtualization | Affected | No fix yet |
| Multicluster Engine for Kubernetes | Affected | No fix yet: Fix deferred |
| Node HealthCheck Operator | Affected | No fix yet |
| OpenShift Pipelines | Affected | No fix yet |
| OpenShift Service Mesh 2 | Affected | No fix planned: Will not fix |
| Red Hat Advanced Cluster Management for Kubernetes 2 | Affected | No fix yet: Fix deferred |
| Red Hat Advanced Cluster Security 4 | Affected | No fix planned: Will not fix |
| Red Hat Ansible Automation Platform 2 | Affected | No fix yet: Fix deferred |
| Red Hat Build of Keycloak | Affected | No fix planned: Out of support scope |
| Red Hat Build of Podman Desktop | Affected | No fix yet: Fix deferred |
| Red Hat Ceph Storage 5 | Affected | No fix yet: Fix deferred |
| Red Hat Ceph Storage 9 | Affected | No fix yet: Fix deferred |
| Red Hat Developer Hub 1 | Affected | No fix planned: Will not fix |
| Red Hat Discovery 2 | Affected | No fix yet: Fix deferred |
| Red Hat Edge Manager 1 | Affected | No fix yet: Fix deferred |
| Red Hat Enterprise Linux 10 | Affected | No fix yet: Fix deferred |
| Red Hat Enterprise Linux 8 | Affected | No fix yet: Fix deferred |
| Red Hat Enterprise Linux 9 | Affected | No fix yet: Fix deferred |
| Red Hat Fuse 7 | Affected | No fix planned: Out of support scope |
| Red Hat OpenShift AI (RHOAI) | Affected | No fix yet |
| Red Hat OpenShift Container Platform 4 | Affected | No fix yet: Fix deferred |
| Red Hat OpenShift Container Platform 5 | Affected | No fix yet |
| Red Hat OpenShift GitOps | Affected | No fix planned: Will not fix |
| Red Hat OpenShift distributed tracing 3 | Affected | No fix yet |
| Red Hat Openshift Data Foundation 4 | Affected | No fix yet |
| Red Hat Process Automation 7 | Affected | No fix planned: Out of support scope |
| Red Hat Satellite 6 | Affected | No fix yet: Fix deferred |
| Red Hat Single Sign-On 7 | Affected | No fix planned: Out of support scope |
| Red Hat Trusted Profile Analyzer | Affected | No fix yet |
| Red Hat build of Apache Camel - HawtIO 4 | Affected | No fix planned: Out of support scope |
| Red Hat build of Apicurio Registry 2 | Affected | No fix planned: Out of support scope |
| Red Hat build of Apicurio Registry 3 | Affected | No fix planned: Out of support scope |
| Self-service automation portal 2 | Affected | No fix yet: Fix deferred |
| Red Hat Data Grid 8.6.2 | Fixed | RHSA-2026:41951 |
| Red Hat Migration Toolkit for Applications 8.1 | Fixed | RHSA-2026:50300 |
| Red Hat OpenShift AI 3.4 | Fixed | RHSA-2026:60520 |
| Red Hat OpenShift Dev Spaces 3.29 | Fixed | RHSA-2026:48124 |
| Red Hat Openshift Data Foundation 4.18 | Fixed | RHSA-2026:56431 |
| Red Hat Openshift Data Foundation 4.19 | Fixed | RHSA-2026:56366 |
| Red Hat Trusted Artifact Signer 1.3 | Fixed | RHSA-2026:42085 |
Not affected: 23 products
- Cryostat 4
- Migration Toolkit for Applications 8
- Network Observability Operator
- OpenShift Lightspeed
- OpenShift Service Mesh 2
- OpenShift Service Mesh 3
- Red Hat AMQ Broker 7
- Red Hat JBoss Enterprise Application Platform 8
- Red Hat JBoss Enterprise Application Platform Expansion Pack
- Red Hat Migration Toolkit for Applications 8.1
- Red Hat OpenShift AI (RHOAI)
- Red Hat OpenShift AI 3.4
- Red Hat OpenShift Container Platform 4
- Red Hat OpenShift Container Platform 5
- Red Hat OpenShift Dev Spaces 3.29
- Red Hat OpenShift GitOps
- Red Hat OpenShift Virtualization 4
- Red Hat Openshift Data Foundation 4
- Red Hat Openshift Data Foundation 4.18
- Red Hat Openshift Data Foundation 4.19
- Red Hat Quay 3
- Red Hat Trusted Artifact Signer 1.3
- Red Hat build of Apache Camel for Spring Boot 4
Timeline
- 2026-10-02 Threatist record created from CVE-2026-42342
- 2026-10-03 Alias added: GHSA-8x6r-g9mw-2r78
- 2026-10-27 Affected versions changed · Red Hat
- 2026-10-30 Affected versions changed · Red Hat
References
More remix-run React-router vulnerabilities
- TI-2026-40200 React Router: Unauthenticated Denial of Service via Inefficient Route Matching CVSS 4.0HIGH 8.7
- TI-2026-26400 React Router vulnerable to Denial of Service via reflected user input in single-fetch CVSS 3.1HIGH 7.5
- TI-2026-17723 React Router vulnerable to XSS via Open Redirects CVSS 3.1HIGH 8.0
- TI-2026-17585 React Router SSR XSS in ScrollRestoration CVSS 3.1HIGH 8.2
- TI-2026-30532 Deserialization of untrusted data in remix-run react-router CVSS 3.1HIGH 8.1
- TI-2026-28995 Open redirect in remix-run react-router CVSS 4.0MEDIUM 6.6
Sources
- CVE-2026-42342 · CVE Program
- CVE-2026-42342 · NVD
- FIRST EPSS
- GHSA-8x6r-g9mw-2r78 · GitHub Advisory Database · CC BY 4.0
- CVE-2026-42342 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences