CVE-2026-53668: React Router XSS Vulnerability

CVE-2026-53668 Overview

CVE-2026-53668 is a cross-site scripting (XSS) vulnerability in React Router, a widely-used routing library for React applications. The flaw affects React Router versions 6.30.2 through 6.30.4 and 7.9.6 through 7.12.0. Applications that permit open redirects become vulnerable to XSS when an attacker crafts a malicious link that redirects users to an external site or delivers an XSS payload through the router's path handling logic. The root cause involves how useNavigate processes paths containing double slashes and colons, which allowed attacker-controlled input to be interpreted as absolute URLs. Maintainers fixed the issue in React Router version 7.13.0.

Critical Impact
An attacker can craft a link that abuses open redirect behavior in useNavigate to load attacker-controlled URLs or execute JavaScript in the victim's browser session, resulting in client-side code execution and account compromise.

Affected Products

React Router versions 6.30.2 through 6.30.4
React Router versions 7.9.6 through 7.12.0
React and Remix applications using vulnerable useNavigate paths

Discovery Timeline

2026-07-27 - CVE-2026-53668 published to NVD
2026-07-28 - Last updated in NVD database

Technical Details for CVE-2026-53668

Vulnerability Analysis

The vulnerability is classified as Cross-Site Scripting [CWE-79]. React Router's path resolution logic in packages/react-router/lib/router/utils.ts treated certain malformed path inputs as absolute URLs. When an application accepted user-controlled navigation targets and passed them to useNavigate, an attacker could supply a path such as //evil.com or a colon-containing string that the router interpreted as an external absolute URL rather than a same-origin route. This behavior enabled open redirects to attacker-controlled hosts. In applications that render redirect targets or execute logic based on the resolved location, the same path handling could be leveraged to inject a javascript: URI or otherwise trigger script execution in the victim's browser.

Root Cause

The pre-patch code branched on isAbsoluteUrl(toPathname) and used the raw input as-is when the check returned true. Paths containing embedded double slashes or colons could bypass the intended relative-path resolution and be treated as absolute URLs. Double slashes were only warned about, not normalized, before the absolute-URL check ran.

Attack Vector

Exploitation requires user interaction. An attacker delivers a crafted link (for example, a URL parameter passed through the application's navigation logic) to a victim. When the victim clicks the link, useNavigate resolves the malicious path as an absolute URL, redirecting the browser to an attacker-controlled site or executing script content in the current origin.

typescript

// Security patch in packages/react-router/lib/router/utils.ts
// Fix double slash normalization for `useNavigate` paths with colons (#14718)
  let pathname: string;
  if (toPathname) {
-   if (isAbsoluteUrl(toPathname)) {
-     pathname = toPathname;
+   toPathname = toPathname.replace(/\/\/+/g, "/");
+   if (toPathname.startsWith("/")) {
+     pathname = resolvePathname(toPathname.substring(1), "/");
    } else {
-     if (toPathname.includes("//")) {
-       let oldPathname = toPathname;
-       toPathname = toPathname.replace(/\/\/+/g, "/");
-       warning(
-         false,
-         `Pathnames cannot have embedded double slashes - normalizing ` +
-           `${oldPathname} -> ${toPathname}`,
-       );
-     }
-     if (toPathname.startsWith("/")) {
-       pathname = resolvePathname(toPathname.substring(1), "/");
-     } else {
-       pathname = resolvePathname(toPathname, fromPathname);
-     }
+     pathname = resolvePathname(toPathname, fromPathname);
    }
  } else {
    pathname = fromPathname;

Source: GitHub Commit 3a5b5ad. The patch removes the isAbsoluteUrl fast path and unconditionally collapses repeated slashes before resolving the path, forcing all inputs through same-origin resolution.

Detection Methods for CVE-2026-53668

Indicators of Compromise

Outbound HTTP requests from user browsers to unexpected external hosts immediately after navigation events on the application.
Application logs containing referrer URLs with paths beginning with //, /\/, or containing embedded colons in next, redirect, or returnTo parameters.
Content Security Policy (CSP) violation reports referencing script sources or navigations that do not match the application origin.

Detection Strategies

Perform a software composition analysis (SCA) scan across web application repositories to inventory React Router versions and flag any package resolution in the vulnerable ranges.
Add web application firewall (WAF) rules that inspect query string parameters commonly used for redirects and block values containing leading double slashes, javascript:, or data: schemes.
Review application source code for any route or component that passes untrusted user input directly into useNavigate, navigate(), or <Navigate to=...> without allow-list validation.

Monitoring Recommendations

Enable and monitor CSP reporting with a strict default-src 'self' policy so cross-origin navigation attempts surface in telemetry.
Track click-through referrer patterns and alert on spikes of redirects from application URLs to external domains.
Correlate front-end error monitoring with server-side access logs to identify unusual navigation targets received from user sessions.

How to Mitigate CVE-2026-53668

Immediate Actions Required

Upgrade React Router to version 7.13.0 or later, which contains the path normalization fix.
Audit application code for user-controlled input flowing into useNavigate, redirect(), loader responses, or <Navigate> components.
Enforce an allow-list of permitted redirect destinations for any parameter-driven navigation, rejecting inputs that begin with //, http:, https:, javascript:, or data:.

Patch Information

The vulnerability is fixed in React Router 7.13.0. Refer to the GitHub Security Advisory GHSA-jjmj-jmhj-qwj2, the Pull Request #14718, the 7.18.0 Release Notes, and the Changelog entry for full remediation details. Applications on the 6.x line should evaluate upgrade paths to the patched 7.x release, as no fix has been published for the 6.30.x branch.

Workarounds

Validate every navigation target against a server-side or client-side allow-list of same-origin paths before invoking router APIs.
Strip or normalize leading slashes and reject colons in redirect parameters at the edge (reverse proxy or WAF) until the library upgrade is deployed.
Deploy a strict Content Security Policy that constrains navigation and script sources to trusted origins, reducing the impact of successful open redirect abuse.

bash

# Update React Router to the patched release
npm install react-router@^7.13.0
npm install react-router-dom@^7.13.0

# Verify the resolved version in the dependency tree
npm ls react-router