CVE-2026-53666

A flaw was found in React Router. If an application is configured to allow attacker-supplied input to modify errors during server-side rendering (SSR), a remote attacker could trigger unexpected code execution on the client. This execution could lead to an outbound network request, potentially resulting in limited information disclosure or unintended network activity. This vulnerability specifically affects applications utilizing Framework Mode and Data Mode with manual SSR/hydration.

This Moderate impact flaw in React Router affects applications configured to allow attacker-controlled input to modify server-side rendering (SSR) errors. Exploitation requires specific application-layer code in Framework Mode or Data Mode with manual SSR/hydration, leading to unexpected client-side code execution and potential outbound network requests for limited information disclosure or unintended network activity.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this issue, ensure that custom application code does not permit attacker-controlled input to modify error objects during server-side rendering (SSR) when using React Router in Framework or Data Modes. Review and harden application-layer error handling to prevent such overwrites. Applications not requiring Framework or Data Mode SSR should consider utilizing Declarative Mode, which is unaffected.