CVE-2026-22029

Description

React Router is a router for React. In @remix-run/router version prior to 1.23.2 and react-router 7.0.0 through 7.11.0, React Router (and Remix v1/v2) SPA open navigation redirects originating from loaders or actions in Framework Mode, Data Mode, or the unstable RSC modes can result in unsafe URLs causing unintended javascript execution on the client. This is only an issue if you are creating redirect paths from untrusted content or via an open redirect. There is no impact if Declarative Mode (<BrowserRouter>) is being used. This issue has been patched in @remix-run/router version 1.23.2 and react-router version 7.12.0.

PUBLISHED Reserved 2026-01-05 | Published 2026-01-10 | Updated 2026-07-13 | Assigner GitHub_M

Problem types

CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Product status

References

access.redhat.com/security/cve/CVE-2026-22029 vdb-entry

bugzilla.redhat.com/show_bug.cgi?id=2428412 (RHBZ#2428412) issue-tracking

security.access.redhat.com/...2/vex/2026/cve-2026-22029.json

access.redhat.com/errata/RHSA-2026:3959 vendor-advisory

access.redhat.com/errata/RHSA-2026:3958 vendor-advisory

access.redhat.com/errata/RHSA-2026:5633 vendor-advisory

access.redhat.com/errata/RHSA-2026:8229 vendor-advisory

access.redhat.com/errata/RHSA-2026:36882 vendor-advisory

access.redhat.com/errata/RHSA-2026:2572 vendor-advisory

access.redhat.com/errata/RHSA-2026:13548 vendor-advisory

access.redhat.com/errata/RHSA-2026:1517 vendor-advisory

access.redhat.com/errata/RHSA-2026:2350 vendor-advisory

access.redhat.com/errata/RHSA-2026:2568 vendor-advisory

access.redhat.com/errata/RHSA-2026:3960 vendor-advisory

access.redhat.com/errata/RHSA-2026:2694 vendor-advisory

access.redhat.com/errata/RHSA-2026:36651 vendor-advisory

access.redhat.com/errata/RHSA-2026:3782 vendor-advisory

access.redhat.com/errata/RHSA-2026:19712 vendor-advisory

access.redhat.com/errata/RHSA-2026:34100 vendor-advisory

access.redhat.com/errata/RHSA-2026:21658 vendor-advisory

access.redhat.com/errata/RHSA-2026:20042 vendor-advisory

access.redhat.com/errata/RHSA-2026:20041 vendor-advisory

access.redhat.com/errata/RHSA-2026:17469 vendor-advisory

access.redhat.com/errata/RHSA-2026:17468 vendor-advisory

access.redhat.com/errata/RHSA-2026:17474 vendor-advisory

access.redhat.com/errata/RHSA-2026:2456 vendor-advisory

access.redhat.com/errata/RHSA-2026:2148 vendor-advisory

access.redhat.com/errata/RHSA-2026:2149 vendor-advisory

access.redhat.com/errata/RHSA-2026:2147 vendor-advisory

access.redhat.com/errata/RHSA-2026:26420 vendor-advisory

access.redhat.com/errata/RHSA-2026:26413 vendor-advisory

access.redhat.com/errata/RHSA-2026:3087 vendor-advisory

access.redhat.com/errata/RHSA-2026:13542 vendor-advisory

access.redhat.com/errata/RHSA-2026:9848 vendor-advisory

access.redhat.com/errata/RHSA-2026:5636 vendor-advisory

access.redhat.com/errata/RHSA-2026:8218 vendor-advisory

github.com/...router/security/advisories/GHSA-2w69-qvjg-hvjx

cve.org (CVE-2026-22029)

nvd.nist.gov (CVE-2026-22029)

Download JSON