CVE-2026-53667: React Router XSS Vulnerability

CVE-2026-53667 Overview

CVE-2026-53667 affects React Router, a routing library for React applications. The vulnerability resides in the RSCErrorHandler, which lacks protocol validation when processing redirect locations. Attackers can craft redirects containing dangerous protocols such as javascript:, enabling open redirects from untrusted sources.

The flaw impacts React Router versions 7.11.0 through 7.17.0 and only applies to applications that consume the unstable React Server Components (RSC) APIs. The issue is a follow-up to prior RSC redirect handling work and is tracked under [CWE-79]. The maintainers released a fix in version 7.18.0.

Critical Impact
Applications using the unstable RSC APIs can redirect users to attacker-controlled destinations, enabling phishing and client-side script execution via javascript: URIs.

Affected Products

React Router versions 7.11.0 through 7.17.0
Applications consuming the unstable React Server Components (RSC) APIs
Fixed in React Router version 7.18.0

Discovery Timeline

2026-07-27 - CVE-2026-53667 published to NVD
2026-07-28 - Last updated in NVD database

Technical Details for CVE-2026-53667

Vulnerability Analysis

The vulnerability is an open redirect flaw in the RSCErrorHandler component of React Router. When the handler processes a redirect location string, it does not verify whether the URL uses a safe protocol. An attacker who controls the redirect target can supply a URL beginning with javascript: or another dangerous scheme.

Because the router forwards the location without sanitization, the browser interprets the scheme directly. This produces two distinct impacts: redirection to arbitrary external domains for phishing, and client-side script execution when javascript: URIs are followed. The issue is scoped to consumers of the unstable RSC APIs, limiting the exposed surface to applications that have opted into that codepath.

Root Cause

The RSCErrorHandler accepted redirect locations without invoking any protocol allowlist or blocklist. React Router already tracked an internal invalidProtocols list containing entries such as javascript:, but the RSC error path never consulted it before dispatching the navigation.

Attack Vector

Exploitation requires network-reachable input into an RSC-enabled route and user interaction to follow the redirect. An attacker submits a request whose error response, or associated redirect payload, contains a location using a disallowed scheme. When the victim triggers the flow, the router honors the redirect, sending the browser to the attacker-controlled URI.

typescript

// Security patch: packages/react-router/lib/router/router.ts
// Introduces protocol validation used by the RSC redirect path (#15177)
   "javascript:",
 ];
 
+export function hasInvalidProtocol(location: string): boolean {
+  try {
+    return invalidProtocols.includes(new URL(location).protocol);
+  } catch {
+    return false;
+  }
+}
+
 function normalizeRedirectLocation(
   location: string,
   currentUrl: URL,

Source: GitHub Commit ce596e8

The companion change in packages/react-router/lib/hooks.tsx imports hasInvalidProtocol so the RSC error handler can reject unsafe schemes before issuing navigation.

Detection Methods for CVE-2026-53667

Indicators of Compromise

Redirect responses whose Location header or RSC payload contains javascript:, data:, or vbscript: schemes
Client-side navigation events originating from RSC error boundaries with absolute URLs to unexpected external hosts
Referrer chains showing users transitioning from a legitimate application route directly to an attacker-controlled domain

Detection Strategies

Inspect application dependencies for react-router versions between 7.11.0 and 7.17.0 that also enable the unstable RSC APIs
Add server-side logging around RSC error responses to capture any outbound redirect targets for later review
Deploy Content Security Policy (CSP) reports to surface blocked javascript: navigations that indicate exploitation attempts

Monitoring Recommendations

Alert on Software Composition Analysis (SCA) findings that flag react-router@7.11.0 through react-router@7.17.0 in production builds
Monitor web access logs for anomalous outbound Referer values following RSC endpoints
Track CSP violation reports for script-src and navigate-to directives tied to affected routes

How to Mitigate CVE-2026-53667

Immediate Actions Required

Upgrade react-router to version 7.18.0 or later across all applications
Audit application code for use of the unstable RSC APIs and prioritize those deployments for patching
Rebuild and redeploy client bundles so downstream consumers receive the fixed router logic

Patch Information

The fix ships in React Router 7.18.0. The maintainers introduced a hasInvalidProtocol helper that parses redirect locations with the URL constructor and rejects any protocol contained in the existing invalidProtocols list. Details are documented in the GitHub Security Advisory GHSA-h8fp-f39c-q6mh, the Pull Request #15177, and the React Router 7.18.0 Release Notes.

Workarounds

Disable use of the unstable RSC APIs until the upgrade to 7.18.0 is completed
Wrap redirect handling with a server-side allowlist that rejects any location whose protocol is not http: or https:
Enforce a strict Content Security Policy that blocks javascript: URIs and constrains navigate-to targets to trusted origins

bash

# Upgrade React Router to the patched release
npm install react-router@7.18.0

# Verify the installed version resolves above the vulnerable range
npm ls react-router