CVE-2026-53669: React Router Auth Bypass Vulnerability

CVE-2026-53669 Overview

CVE-2026-53669 is an open redirect vulnerability in React Router, a widely used routing library for React applications. Versions 6.0.0 through 7.17.0 mishandle backslash characters within <Link> components and the useNavigate hook. Attackers can craft URLs that appear to point to a trusted application origin but redirect users to attacker-controlled destinations after user interaction. The issue is a follow-up to CVE-2025-68470 and is tracked under [CWE-601: URL Redirection to Untrusted Site]. The maintainers fixed the flaw in React Router 7.18.0.

Critical Impact
Attackers can abuse trusted React Router applications to redirect authenticated users to phishing or malware distribution sites, undermining URL-based trust decisions.

Affected Products

React Router versions 6.0.0 through 7.17.0
React applications using <Link> components with unsanitized user-controlled paths
React applications invoking useNavigate with attacker-influenced input

Discovery Timeline

2026-07-27 - CVE-2026-53669 published to the National Vulnerability Database (NVD)
2026-07-28 - Last updated in NVD database

Technical Details for CVE-2026-53669

Vulnerability Analysis

React Router provides client-side navigation primitives, including the <Link> component and the useNavigate hook. Both accept string paths that the router resolves against the current origin. The vulnerable versions fail to normalize backslash (\) characters when parsing these paths. Browsers and URL parsers commonly treat backslashes as equivalent to forward slashes, which enables path constructs such as /\attacker.example.com to resolve to an external host rather than a same-origin path.

This behavior converts an internal navigation call into an off-site redirect. Users clicking a <Link> in a trusted single-page application land on an attacker-controlled origin without leaving the expected application flow. The issue extends CVE-2025-68470, which addressed related redirect parsing but did not fully cover backslash-based bypasses.

Root Cause

The router's URL normalization routines validate leading forward slashes to enforce same-origin navigation but do not treat backslashes equivalently. Because the browser layer collapses \ to / during URL resolution, the router's origin check passes while the final navigation target resolves to a different host.

Attack Vector

Exploitation requires an application that renders a <Link>to prop or calls useNavigate with data derived from untrusted input such as query parameters, referrer values, or stored records. The attacker supplies a payload of the form /\evil.example.com or \\evil.example.com/path. When the victim activates the link, the browser navigates to evil.example.com under the illusion of a same-origin transition. User interaction is required, and no privileges are needed. See the GitHub Security Advisory GHSA-wrjc-x8rr-h8h6 for the technical writeup.

Detection Methods for CVE-2026-53669

Indicators of Compromise

Outbound HTTP referrers from the application origin followed by immediate redirects to unfamiliar external hosts.
Web server or CDN access logs containing request paths beginning with \, /\, or URL-encoded %5C sequences targeting routing endpoints.
Phishing reports from users describing links that appeared to originate from the trusted application domain.

Detection Strategies

Inventory dependencies with npm ls react-router and npm ls react-router-dom to identify versions 6.0.0 through 7.17.0.
Perform static analysis on the frontend source to locate <Link to={...}> and useNavigate() usages that consume query strings, URL fragments, or backend-supplied redirect values.
Scan reverse-proxy and Web Application Firewall (WAF) logs for backslash characters in request paths or Location response headers.

Monitoring Recommendations

Alert on HTTP responses containing Location headers with backslash characters or mixed slash sequences.
Track anomalous referrer patterns where users leave the application to previously unseen external domains shortly after visiting routing endpoints.
Monitor Content Security Policy (CSP) navigate-to or frame-src violation reports for unexpected destinations.

How to Mitigate CVE-2026-53669

Immediate Actions Required

Upgrade React Router to version 7.18.0 or later across all affected applications.
Audit every <Link> and useNavigate call site for untrusted input and add allow-list validation for target paths.
Rebuild and redeploy production bundles to ensure users receive the patched library rather than cached vulnerable assets.

Patch Information

The fix is included in React Router 7.18.0. Reference the React Router 7.18.0 release, the CHANGELOG entry for v7.18.0, and the corrective pull request #15176. The patch normalizes backslash characters during URL parsing so that they cannot be used to escape same-origin navigation.

Workarounds

Reject or sanitize any navigation target that contains \ or %5C before passing it to <Link> or useNavigate.
Restrict navigation input to a server-defined allow-list of internal paths rather than reflecting user-supplied URLs.
Deploy a Content Security Policy with a restrictive form-action and navigate-to directive to constrain redirect destinations.

bash

# Configuration example
npm install react-router@^7.18.0 react-router-dom@^7.18.0
npm ls react-router react-router-dom
npm audit --production