CVE-2026-40181

A flaw was found in React Router. This vulnerability allows a remote attacker to redirect users to an external, potentially malicious, website. This occurs when specially crafted URLs, containing paths starting with //, are passed to the redirect function, causing them to be misinterpreted as protocol-relative URLs. The severity of the impact depends on how the application validates redirects.

A Moderate impact open redirect vulnerability exists in React Router, affecting versions 7.0.0 through 7.14.0 and 6.7.0 through 6.30.3. This flaw allows a remote attacker to redirect users to arbitrary external websites by crafting URLs that begin with //, which are then misinterpreted as protocol-relative. The exploitability and actual impact on Red Hat products depend on the specific application's redirect validation logic. Applications utilizing React Router in Declarative Mode (<BrowserRouter>) are not affected by this issue.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Application developers using React Router in Red Hat products should implement robust URL validation before performing redirects to prevent misinterpretation of protocol-relative URLs. Additionally, applications configured with Declarative Mode (<BrowserRouter>) are not impacted by this vulnerability. Users should exercise caution when interacting with untrusted links.