CVE-2026-53666: React Router SSRF Vulnerability

CVE-2026-53666 Overview

CVE-2026-53666 affects React Router, a widely used routing library for React applications. The vulnerability exists in versions 6.4.0 through 7.17.0 and involves unsafe deserialization of errors caught during server-side rendering (SSR). When application code allows attacker-controlled input to overwrite properties of caught SSR errors, an attacker can trigger unexpected constructor execution on the client. That execution can subsequently issue outbound network requests. The flaw is scoped to Framework Mode and Data Mode applications that perform manual SSR and hydration. Declarative Mode applications are not affected. The maintainers addressed the issue in version 7.18.0 by removing the deserializeErrors path and using turbo stream for framework hydration errors.

Critical Impact
Attacker-influenced SSR error data can invoke arbitrary constructors on the client, enabling outbound network requests and potential data exfiltration through hydration.

Affected Products

React Router 6.4.0 through 6.x (Framework Mode / Data Mode with manual SSR)
React Router 7.0.0 through 7.17.0 (Framework Mode / Data Mode with manual SSR)
Applications performing manual SSR/hydration using UNSAFE_deserializeErrors

Discovery Timeline

2026-07-27 - CVE-2026-53666 published to the National Vulnerability Database
2026-07-28 - Last updated in NVD database

Technical Details for CVE-2026-53666

Vulnerability Analysis

The issue is categorized as [CWE-470]: Use of Externally-Controlled Input to Select Classes or Code (Unsafe Reflection). React Router's SSR pipeline serializes errors thrown during rendering and rehydrates them on the client. The deserialization routine reconstructs error objects by referencing constructors keyed on serialized fields. When an application permits attacker-supplied input to overwrite these fields on caught errors, the client-side deserializer selects and invokes a constructor influenced by that input. Constructor execution during hydration can trigger side effects, including outbound HTTP requests, enabling data exposure or interaction with attacker-controlled endpoints. Exploitation requires user interaction and specific application-layer code patterns, which limits real-world exposure.

Root Cause

The root cause is unsafe reconstruction of error objects during client hydration. The internal UNSAFE_deserializeErrors helper reconstitutes error instances from a serialized payload without constraining which constructors may be invoked. If application code writes untrusted input into the caught error object before it is serialized by the SSR path, the deserializer will honor those fields on the client. This produces a reflection-style primitive during hydration.

Attack Vector

The attack requires a Framework Mode or Data Mode application performing manual SSR/hydration where user-controlled data can influence fields of an error caught by the SSR process. An attacker delivers crafted input via a request parameter or user-triggered flow that surfaces as a rendering error. The server serializes the tainted error; the client deserializes it during hydration and invokes the attacker-selected constructor. The resulting execution can initiate an outbound network request from the victim's browser.

typescript

// Security patch: packages/react-router/index.ts
// The public re-export of the unsafe deserializer was removed.

 /** @internal */
 export type { AssetsManifest as UNSAFE_AssetsManifest } from "./lib/dom/ssr/entry";
 
-/** @internal */
-export { deserializeErrors as UNSAFE_deserializeErrors } from "./lib/dom/ssr/errors";
-
 /** @internal */
 export { RemixErrorBoundary as UNSAFE_RemixErrorBoundary } from "./lib/dom/ssr/errorBoundaries";

Source: GitHub Commit 9d22943

text

// Security patch: packages/react-router/lib/dom-export/hydrated-router.tsx
// The hydrated router no longer imports deserializeErrors; framework
// hydration errors are now delivered via the turbo stream data path.

   UNSAFE_createBrowserHistory as createBrowserHistory,
   UNSAFE_createClientRoutes as createClientRoutes,
   UNSAFE_createRouter as createRouter,
-  UNSAFE_deserializeErrors as deserializeErrors,
   UNSAFE_getTurboStreamSingleFetchDataStrategy as getTurboStreamSingleFetchDataStrategy,
   UNSAFE_getPatchRoutesOnNavigationFunction as getPatchRoutesOnNavigationFunction,
   UNSAFE_useFogOFWarDiscovery as useFogOFWarDiscovery,

Source: GitHub Pull Request #15175

Detection Methods for CVE-2026-53666

Indicators of Compromise

Unexpected outbound HTTP requests from browser sessions immediately after page hydration on routes that render error boundaries.
Serialized SSR payloads containing attacker-influenced fields such as name, message, or constructor identifiers on error objects.
Browser telemetry showing constructor invocations or fetches originating from React Router hydration frames on affected routes.
Presence of UNSAFE_deserializeErrors imports in application bundles built against React Router 6.4.0 through 7.17.0.

Detection Strategies

Perform a software composition analysis (SCA) scan across build manifests and lockfiles for react-router versions less than 7.18.0.
Audit application code for handlers that write user-controlled input into caught error objects before they cross the SSR boundary.
Review server logs for repeated error-triggering requests that carry serialized payload-like parameters against Framework Mode or Data Mode routes.

Monitoring Recommendations

Enforce a strict Content Security Policy (CSP) and log CSP violations to identify unexpected outbound connections initiated during hydration.
Monitor egress from browser sessions to non-allowlisted domains using web proxy or browser telemetry.
Track dependency drift and alert when production builds ship with vulnerable React Router versions.

How to Mitigate CVE-2026-53666

Immediate Actions Required

Upgrade React Router to version 7.18.0 or later across all Framework Mode and Data Mode applications performing manual SSR/hydration.
Audit application code paths that catch SSR errors and remove any assignment of untrusted input onto error object properties.
Rebuild and redeploy client bundles to ensure the patched runtime is delivered to users; cached bundles remain vulnerable.

Patch Information

The fix landed in React Router 7.18.0 via GitHub Pull Request #15175 and commit 9d22943. The patch removes the exported UNSAFE_deserializeErrors helper and switches framework hydration errors to the turbo stream data path, eliminating the reflection-based reconstruction. Details are documented in the GitHub Security Advisory GHSA-337j-9hxr-rhxg and the GitHub Changelog Version 7.18.0.

Workarounds

Migrate affected routes to Declarative Mode, which does not use the vulnerable deserialization path.
Strictly sanitize and validate all user input before it can reach any error object caught by the SSR pipeline.
Deploy a restrictive CSP that limits connect-src and default-src to trusted origins to blunt outbound requests from hijacked hydration.

bash

# Update React Router to the patched release
npm install react-router@^7.18.0

# Verify the resolved version in the lockfile
npm ls react-router

# Rebuild production assets so clients receive patched bundles
npm run build