CyberRota Analysis
AI-GeneratedVersions 7.0.0 through 7.17.0 of React Router are vulnerable to unauthenticated access to the manifest endpoint, which can lead to significant server load and degraded response times. This vulnerability primarily affects applications not using Declarative Mode or Data Mode. Organizations utilizing these affected versions should prioritize upgrading to version 7.18.0 to mitigate potential performance impacts.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
React Router is a router for React. In versions 7.0.0 through 7.17.0, the manifest endpoint could be accessed via unauthenticated targeted requests that would put heavy load on the server and slow down response times. This issue is a follow up to CVE-2026-42342, and does not does not impact React Router applications using Declarative Mode (<BrowserRouter>) or Data Mode (createBrowserRouter/<RouterProvider>). This issue has been fixed in version 7.18.0.
Related CVEs
Other vulnerabilities affecting the same vendor(s)