CVE-2026-55685: React Router DoS Vulnerability

CVE-2026-55685 Overview

CVE-2026-55685 is a denial-of-service vulnerability in React Router, a routing library for React applications. The flaw affects React Router versions 7.0.0 through 7.17.0 when the Framework Mode manifest endpoint is exposed. Unauthenticated attackers can send targeted requests to the manifest endpoint that force expensive route-matching operations on the server. Repeated requests degrade server response times and can exhaust processing capacity. This vulnerability is a follow-up to CVE-2026-42342 and is categorized under [CWE-400] Uncontrolled Resource Consumption. Applications using Declarative Mode (<BrowserRouter>) or Data Mode (createBrowserRouter/<RouterProvider>) are not affected. The maintainers resolved the issue in version 7.18.0.

Critical Impact
Unauthenticated remote attackers can exhaust server resources by issuing crafted requests to the React Router manifest endpoint, resulting in high availability impact.

Affected Products

React Router 7.0.0 through 7.17.0 (Framework Mode)
Applications running @react-router/server builds that expose the manifest endpoint
Server-side rendered (SSR) React Router deployments in Framework Mode

Discovery Timeline

2026-07-27 - CVE-2026-55685 published to NVD
2026-07-28 - Last updated in NVD database

Technical Details for CVE-2026-55685

Vulnerability Analysis

The vulnerability resides in React Router's Framework Mode manifest endpoint, which powers the Fog of War lazy route discovery feature. When a client requests routes, the server calls into route-matching internals to determine which route definitions to return in the partial manifest. An attacker can send unauthenticated requests containing paths that trigger disproportionately expensive matching work on the server.

Each request forces the router to walk route trees, resolve ancestor segments, and evaluate path patterns without a compiled cache. Sustained requests amplify CPU consumption and delay legitimate responses. The impact is confined to availability; confidentiality and integrity are not affected.

Root Cause

The root cause is inefficient route-matching internals in the manifest endpoint pipeline. Route matchers and parameter compilers were rebuilt on each request instead of being cached, and ancestor-path resolution iterated the route tree more than necessary. This algorithmic cost, combined with an unauthenticated attack surface, produces the resource-exhaustion condition described by [CWE-400].

Attack Vector

Exploitation requires only network access to a vulnerable React Router server running in Framework Mode. No authentication, user interaction, or elevated privileges are required. An attacker issues repeated crafted requests to the manifest endpoint, each of which triggers costly route-matching work. Applications using Declarative Mode or Data Mode do not expose the vulnerable endpoint.

typescript

// Security patch in packages/react-router/lib/dom/ssr/fog-of-war.ts
// Optimize route matching internals (#15186)

// https://stackoverflow.com/a/417184
export const URL_LIMIT = 7680;

export function getPathsWithAncestors(paths: string[]): string[] {
  let result = new Set<string>();

  paths.forEach((path) => {
    if (!path.startsWith("/")) {
      path = `/${path}`;
    }
    // In addition to the requested path, we need to include patches for each
    // ancestor path so that we pick up any pathless/index routes below ancestor
    // segments. So if we get a request for `/parent/child`, we need to look for
    // a match on `/parent` so that if a `parent._index` route exists we return
    // it and it's available for client side matching if the user routes back up
    // to `/parent`. This is the same thing we do on initial load in <Scripts>
    // via `getPartialManifest()`.
    for (let i = 1; i < path.length; i++) {
      if (path[i] === "/") {
        result.add(path.slice(0, i));
      }
    }
    result.add(path);
  });

  return Array.from(result);
}

export function isFogOfWarEnabled(
  routeDiscovery: ServerBuild["routeDiscovery"],

Source: React Router Commit 09e6020

The patch introduces getPathsWithAncestors to deduplicate ancestor path resolution and adds cached matcher and compiledParams fields to route match objects, eliminating repeated regex compilation on every request:

typescript

// Security patch in packages/react-router/lib/router/utils.ts
caseSensitive: boolean;
childrenIndex: number;
route: RouteObjectType;
matcher?: RegExp;
compiledParams?: CompiledPathParam[];

Source: React Router Commit 09e6020

Detection Methods for CVE-2026-55685

Indicators of Compromise

Sustained bursts of unauthenticated requests to the React Router manifest endpoint (typically /__manifest) from a single source or distributed set of sources
Elevated CPU utilization on React Router SSR server processes correlated with manifest endpoint traffic
Increased latency on legitimate routes while manifest requests dominate server time
Requests to the manifest endpoint carrying unusually long or numerous paths query parameters

Detection Strategies

Inspect web server and reverse-proxy access logs for high-frequency GET requests to the manifest endpoint from non-browser user agents
Correlate application performance monitoring (APM) traces showing time-in-route-matching spikes with inbound manifest traffic
Compare production dependency manifests against the vulnerable version range (react-router 7.0.0 through 7.17.0) to identify at-risk services

Monitoring Recommendations

Alert on sustained request rates to the manifest endpoint that exceed baseline per-source thresholds
Track React Router version metadata across build pipelines and container images
Monitor Node.js event loop lag and CPU saturation on SSR servers as leading indicators of resource exhaustion

How to Mitigate CVE-2026-55685

Immediate Actions Required

Upgrade React Router to version 7.18.0 or later across all Framework Mode deployments
Inventory applications for the vulnerable version range and prioritize internet-exposed SSR servers
Apply rate limiting to the manifest endpoint at the reverse proxy, CDN, or WAF layer
Confirm which routing mode each application uses; Declarative Mode and Data Mode deployments are not affected

Patch Information

The fix is available in React Router 7.18.0. Review the React Router Release v7.18.0 notes, the React Router Changelog v7.18.0, and the merged React Router Pull Request #15186 for full context. The GitHub Security Advisory GHSA-8x6r-g9mw-2r78 and GitHub Security Advisory GHSA-chx6-hx7r-mcp5 document the vulnerability and patched commit 09e6020.

Workarounds

Restrict access to the manifest endpoint using WAF rules that enforce per-IP rate limits and bot filtering
Cache manifest responses at the CDN or reverse proxy to absorb repeated identical requests
Migrate affected applications to Declarative Mode (<BrowserRouter>) or Data Mode (createBrowserRouter) if upgrading is not immediately feasible
Deploy autoscaling policies to isolate impact until the patched version is rolled out

bash

# Configuration example - upgrade React Router to the patched release
npm install react-router@^7.18.0

# Verify the installed version resolves to 7.18.0 or later
npm ls react-router