Your RSA-2048 keys break in 2030. Find every one of them before attackers do.
📦 npm
Not in CISA KEV

CVE-2026-40181 — react-router

Fix: remix-run/react-router@d77f6b1

CVE-2026-40181 is a Open Redirect vulnerability in react-router. A fix is available for react-router — see the affected versions and patch details below.

React Router's same-origin redirect with path starting // causes open redirect via protocol-relative URL reinterpretation

Also known asGHSA-2j2x-hqr9-3h42
Published
Updated
Affected
3 pkgs
Patched
3 / 3
Exploits
None indexed
Exploitation data as of Oct 15, 2026 · OSV.dev, NVD, FIRST.org (EPSS)

Exploitation Status

No confirmed exploitation observed yet

  • CISA assesses this as automatable — exploitation doesn’t require manual, per-target effort, which raises the odds of mass scanning and opportunistic attacks.
  • CISA’s own triage has not observed active exploitation or public proof-of-concept code for this CVE as of its last assessment.

Exploitation and automatability from CISA’s SSVC triage for CVE-2026-40181.

EPSS Exploitation Probability

via FIRST.org ↗
0.3%probability of exploitation in next 30 days
Lower Risk+0.01%
Lower risk than most CVEs18th percentile — riskier than 18% of all scored CVEsHighest risk
0.00%0.26%0.52%0.77%0.2%0.2%0.2%0.3%0.3%Jul 26Sep 26Oct 26

Probability of exploitation in the next 30 days, from FIRST.org EPSS.

Real-World Exposure

3 pkgs affected

How broadly this vulnerability is actually deployed: weekly install volume shows current usage, and reverse-dependency count shows how many other packages break if it stays unpatched.

9Kother npm packages depend on this — each one inherits the vulnerability until it's patched upstream
react-routernpm
56.8Mdownloads / week
@remix-run/routernpm
20.4Mdownloads / week

Description

React Router is a router for React. In versions 7.0.0 through 7.14.0 and 6.7.0 through 6.30.3, certain URLs passed to the redirect function can trigger an open redirect to an external domain due to path values starting with // being reinterpreted as protocol-relative URLs. The level of impact depends on the validation done by the application prior to returning the redirect. This does not impact applications using Declarative Mode (<BrowserRouter>). This is patched in versions 7.14.1 and 6.30.4.

Affected Packages

3 total 3 fixed
EcosystemPackageVulnerable rangeFix
📦npmreact-router≥ 7.0.0&&< 7.14.17.14.1npm install react-router@7.14.1
📦npmreact-router≥ 6.7.0&&< 6.30.46.30.4npm install react-router@6.30.4
📦npm@remix-run/router≥ 1.3.0&&< 1.23.31.23.3npm install @remix-run/router@1.23.3

Affected Products

1 product · 2 configurations
Application
react-routershopify
≥ 7.0.0 && < 7.14.1
range

Detection & mitigation playbook

Open-source dependency

  1. Detect

    Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for react-router, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.

  2. Fix

    Update react-router to 7.14.1 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms CVE-2026-40181 is resolved across your whole dependency graph.

  3. Workarounds

    Stop reflecting attacker-controlled destinations: resolve every redirect target against an allowlist of paths or hosts you own, prefer a server-side key over a full URL in the request, and reject absolute URLs entirely where the flow only ever needs a relative one.

Fixing This On Your OS

If you run this on a Linux distribution, patch through your package manager against the distro's own security advisory below — it tracks the exact backported fix for your release, which can ship on a different timeline (and sometimes a different severity) than the upstream project.

Red HatModerate

A Moderate impact open redirect vulnerability exists in React Router, affecting versions 7.0.0 through 7.14.0 and 6.7.0 through 6.30.3. This flaw allows a remote attacker to redirect users to arbitrary external websites by crafting URLs that begin with `//`, which are then misinterpreted as protocol-relative. The…

Workaround published by Red Hat
Application developers using React Router in Red Hat products should implement robust URL validation before performing redirects to prevent misinterpretation of protocol-relative URLs. Additionally, applications configured with Declarative Mode (<BrowserRouter>) are not impacted by this vulnerability. Users should exercise caution when interacting with untrusted links.
Source: Red Hat security advisory for CVE-2026-40181 (CC BY 4.0)
ProductFixed inAdvisory
Red Hat Openshift Data Foundation 4.18odf4/cephcsi-rhel9:1786705347RHSA-2026:56431
Red Hat Openshift Data Foundation 4.22odf4/cephcsi-rhel9:1787057250RHSA-2026:56928

Frequently Asked Questions

React Router is a router for React. In versions 7.0.0 through 7.14.0 and 6.7.0 through 6.30.3, certain URLs passed to the redirect function can trigger an open redirect to an external domain due to path values starting with // being reinterpreted as protocol-relative URLs. The level of impact depends on the validation done by the application prior to returning the redirect. This does not impact applications using Declarative Mode (<BrowserRouter>). This is patched in versions 7.14.1 and 6.30.4.
O3 Security · Impact-Aware SCA

Is CVE-2026-40181 in your dependencies?

Find it across npm, including transitive dependencies.

Scan my dependencies How O3 SCA works
CVE-2026-40181: react-router — Fixed in 7.14.1