CVE-2026-33244: React Router has stored XSS via unescaped Location header in prerendered redirect HTML
(updated )
When using React Router v7 Framework Mode with Pre-rendering enabled, an improper neutralization of the HTTP Location header value can permit Cross-Site Scripting (XSS) in statically generated HTML files if the redirect location comes from an untrusted source.
[!NOTE] This does not impact your React Router application if you are using Declarative Mode (
<BrowserRouter>) or Data Mode (createBrowserRouter/<RouterProvider>).
References
- github.com/advisories/GHSA-f22v-gfqf-p8f3
- github.com/remix-run/react-router/blob/react-router%407.13.2/CHANGELOG.md
- github.com/remix-run/react-router/commit/ea28e66926460656815cee9b7f2dfaa872513a8c
- github.com/remix-run/react-router/pull/14880
- github.com/remix-run/react-router/security/advisories/GHSA-f22v-gfqf-p8f3
- nvd.nist.gov/vuln/detail/CVE-2026-33244
Code Behaviors & Features
Detect and mitigate CVE-2026-33244 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →