CVE-2026-40181
React Router's same-origin redirect with path starting // causes open redirect via protocol-relative URL reinterpretation
- State
- Published
- Severity
- 6.6 Medium
- Published
- Jun 2, 2026
- Updated
- Aug 4, 2026
- Reserved
- Apr 9, 2026
Description
React Router is a router for React. In versions 7.0.0 through 7.14.0 and 6.7.0 through 6.30.3, certain URLs passed to the redirect function can trigger an open redirect to an external domain due to path values starting with // being reinterpreted as protocol-relative URLs. The level of impact depends on the validation done by the application prior to returning the redirect. This does not impact applications using Declarative Mode (<BrowserRouter>). This is patched in versions 7.14.1 and 6.30.4.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 6.6 Medium | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:U | GitHub_M |
Weaknesses
- CWE-601 URL Redirection to Untrusted Site ('Open Redirect')
Affected Products
| Product | Versions |
|---|---|
react-routerremix-run |
|
@remix-run/routerremix-run |
|
References
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.