CVE-2026-42342: React Router vulnerable to DoS via unbounded path expansion in __manifest endpoint

June 3, 2026

There exists a potential DOS attack vector in React Router Framework Mode applications (as well as Remix v2.10.0 - 2.17.4). Certain requests can be crafted to consume disproportionate resources on the server, resulting in response time degredation and/or service unavailability for end users.

[!NOTE] This does not impact your React Router application if you are using Declarative Mode (<BrowserRouter>) or Data Mode (createBrowserRouter/<RouterProvider>).

References

github.com/advisories/GHSA-8x6r-g9mw-2r78
github.com/remix-run/react-router/security/advisories/GHSA-8x6r-g9mw-2r78
nvd.nist.gov/vuln/detail/CVE-2026-42342

Code Behaviors & Features

Detect and mitigate CVE-2026-42342 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →