CVE-2026-55685 remix-run CVE debrief

Who should care

Developers and administrators using React Router versions 7.0.0 through 7.17.0 should be aware of this vulnerability and take steps to mitigate potential risks. This includes reviewing and implementing additional security measures to protect against potential denial-of-service attacks, monitoring React Router applications for unusual traffic patterns or performance issues, and prioritizing upgrades to version 7.18.0 or later. Security teams and vulnerability management teams should also review the official advisory and assess their environment for potential exposure.

Technical summary

A vulnerability in React Router versions 7.0.0 through 7.17.0 allows unauthenticated targeted requests to access the manifest endpoint, potentially causing denial-of-service attacks. This issue does not impact applications using Declarative Mode or Data Mode. The vulnerability has been fixed in version 7.18.0. Affected organizations should assess their deployments and prioritize upgrading to the patched version to mitigate potential risks.

Defensive priority

Organizations using React Router versions 7.0.0 through 7.17.0 should prioritize upgrading to version 7.18.0 to mitigate potential denial-of-service attacks via the manifest endpoint.

Recommended defensive actions

• Upgrade React Router to version 7.18.0 or later
• Review and implement additional security measures to protect against potential denial-of-service attacks
• Monitor React Router applications for unusual traffic patterns or performance issues
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The CVE record and NVD entry provide details on the vulnerability in React Router versions 7.0.0 through 7.17.0. Evidence is based on official CVE and NVD sources, as well as references from the React Router GitHub repository. To verify, defenders should review the official advisory and assess their environment for potential exposure. Additional verification steps include checking for unusual traffic patterns or performance issues in React Router applications.

Official resources