Open Redirect in Remix-Run React-Router
CVE-2026-40181
React Router is a router for React. In versions 7.0.0 through 7.14.0 and 6.7.0 through 6.30.3, certain URLs passed to the redirect function can trigger an open redirect to an external domain due to path values starting with // being reinterpreted as protocol-relative URLs. The level of impact depends on the validation done by the application prior to returning the redirect. This does not impact applications using Declarative Mode (<BrowserRouter>). This is patched in versions 7.14.1 and 6.30.4.
Vulnerability class: Open Redirect
EPSS: 0.002 (11.4th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 6.1 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N.
Affected products
- Remix-run React-router — versions >= 7.0.0, < 7.14.1, >= 6.7.0, < 6.30.4
- Remix-run @Remix-run/router — versions >= 1.3.0, < 1.23.3
- Shopify React-router
Weakness classification (CWE)
References
- security-advisories@github.com (x_refsource_CONFIRM, Vendor Advisory)
Frequently asked questions
- What is CVE-2026-40181?
- CVE-2026-40181 is a medium-severity vulnerability in Remix-Run React-Router, classified under URL Redirection to Untrusted Site (Open Redirect). CVSS score: 6.1/10. Published 2026-06-02.
- How severe is CVE-2026-40181?
- Medium severity. CVSS v3 base score is 6.1 out of 10.