CVE-2026-42211

Published Jun 2, 2026

Last updated 14 hours ago

Overview

AI description

Automated description summarized from trusted sources.

CVE-2026-42211 describes a vulnerability in React Router versions 7.0.0 through 7.14.1, specifically when the library is used in Framework Mode. This flaw can potentially lead to unauthorized remote code execution (RCE) through external requests. The vulnerability stems from a deserialization issue within React Router's vendored `turbo-stream` v2, which permits arbitrary constructor invocation via `TYPE_ERROR` deserialization. Exploiting CVE-2026-42211 is a two-step process. It first requires the application code to have an existing prototype pollution vulnerability, which can then be leveraged to trigger the unauthorized RCE on the remote server. Applications utilizing Declarative Mode (`<BrowserRouter>`) or Data Mode (`createBrowserRouter/<RouterProvider>`) are not affected by this vulnerability. The issue has been addressed in React Router version 7.14.2.

Description: React Router is a router for React. In versions 7.0.0 through 7.14.1, when using Framework Mode, a combination of steps could potentially allow unauthorized remote code execution (RCE) through external requests. This attack requires the application code to have an existing prototype pollution vulnerability, which can then be leveraged in a 2-step attack where the second step triggers unauthorized RCE on the remote server. This does not impact applications using Declarative Mode (`<BrowserRouter>`) or Data Mode (`createBrowserRouter/<RouterProvider>`). This is patched in version 7.14.2.
Source: security-advisories@github.com
NVD status: Analyzed
Products: react-router

Risk scores

CVSS 3.1

Type: Secondary
Base score: 8.1
Impact score: 5.9
Exploitability score: 2.2
Vector string: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Severity: HIGH

Weaknesses

security-advisories@github.com: CWE-502

Hype score is a measure of social media activity compared against trending CVEs from the past 12 months. Max score 100.

Hype score: 4

Configurations

[
  {
    "nodes": [
      {
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:shopify:react-router:*:*:*:*:*:node.js:*:*",
            "matchCriteriaId": "02931B5A-0559-41CC-8566-D6C018538F2C",
            "versionEndExcluding": "7.14.2",
            "versionStartIncluding": "7.0.0",
            "vulnerable": true
          }
        ],
        "negate": false,
        "operator": "OR"
      }
    ]
  }
]

References

Sources include official advisories and independent security research.