CVE Tools
Track your stack

Remix-run

6 CVEs tracked since 2026. Since Jan 2026, none of them reached CISA KEV.

Remix-run CVEs per month

Jan 2026 to Jan 2026. Point at a month, or focus the strip and use the arrow keys.
Remix-run CVEs per month, with the share now in CISA KEV
MonthCVEsIn CISA KEV
2026-0160

Products

The products that kept showing up in Remix-run's monthly top three, with their CVEs summed over those months.

  1. React-router61 month
  2. @remix-run/router11 month

Latest CVEs

The 15 most recently published vulnerabilities affecting Remix-run.

  1. CVE-2026-53669React Router: Open redirect via backslash in <Link> and useNavigate (CVE-2025-68470 bypass)6.1
  2. CVE-2026-55685React Router: Unauthenticated Denial of Service via Inefficient Route Matching7.5
  3. CVE-2026-53668React Router: Open redirect can lead to XSS6.9
  4. CVE-2026-53667React Router: Cross-site Scripting is Possible due to Missing RSCErrorHandler Protocol Validation (Incomplete fix for CVE-2026-53667)6.9
  5. CVE-2026-53666React Router: Arbitrary Constructor Injection via deserializeErrors() in React Router SSR Hydration6.1
  6. CVE-2026-53663React Router: `handleDocumentRequest` CSRF check covers `POST` only; PUT/PATCH/DELETE bypass3.1
  7. CVE-2026-42342React Router vulnerable to DoS via unbounded path expansion in __manifest endpoint7.5
  8. CVE-2026-42211React Router's vendored turbo-stream v2 allows arbitrary constructor invocation via TYPE_ERROR deserialization leading to Unauth RCE8.1
  9. CVE-2026-40181React Router's same-origin redirect with path starting // causes open redirect via protocol-relative URL reinterpretation6.1
  10. CVE-2026-34077React Router vulnerable to Denial of Service via reflected user input in single-fetch7.5
  11. CVE-2026-33245React Router vulnerable to XSS in unstable RSC redirect handling via javascript: redirect targets8.0
  12. CVE-2026-33244React Router has stored XSS via unescaped Location header in prerendered redirect HTML5.4
  13. CVE-2026-22030React Router has CSRF issue in Action/Server Action Request Processing6.5
  14. CVE-2026-22029React Router vulnerable to XSS via Open Redirects8.0
  15. CVE-2026-21884React Router SSR XSS in ScrollRestoration8.2

The record

Peak rank
#159 in Jan 2026
Busiest month shown
Jan 2026, 6 CVEs
Months with a KEV entry
0 since Jan 2026
Monthly snapshots
1 since 2026
Remix-run's full record, month by month

We use analytics cookies to see which pages and articles actually help people. Decline and none of them run — the site works the same. What we store