What is CVE-2026-34077?

CVE-2026-34077 is a high-severity vulnerability in Remix-Run React-Router, classified under Allocation of Resources Without Limits or Throttling. CVSS score: 7.5/10. Published 2026-06-02.

How severe is CVE-2026-34077?

High severity. CVSS v3 base score is 7.5 out of 10.

Resource exhaustion in Remix-Run React-Router

CVE-2026-34077

React Router is a router for React. In versions 7.7.0 through 7.13.1, when using React Router's unstable React Server Components (RSC) APIs, there is a potential client-side Cross-Site Scripting (XSS) vulnerability in the RSC redirect handling if redirects come from untrusted sources. This does not impact applications that are not using the unstable RSC APIs in React Router. This is patched in version 7.13.2.

EPSS: 0.003 (21.8th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 7.5 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H.

Affected products

Remix-run React-router — versions >= 7.0.0, < 7.14.0
Remix-run Turbo-stream — versions < 3.0.0
Shopify React-router
Turbo-stream Turbo_stream

Weakness classification (CWE)

CWE-770 — Allocation of Resources Without Limits or Throttling

References

security-advisories@github.com (x_refsource_CONFIRM, Vendor Advisory)

Frequently asked questions

What is CVE-2026-34077?: CVE-2026-34077 is a high-severity vulnerability in Remix-Run React-Router, classified under Allocation of Resources Without Limits or Throttling. CVSS score: 7.5/10. Published 2026-06-02.
How severe is CVE-2026-34077?: High severity. CVSS v3 base score is 7.5 out of 10.