Skip to content

Product

remix-run @remix-run/react vulnerabilities

2 published CVES affecting remix-run @remix-run/react, from public sources (CVE.org, NVD, CISA KEV, FIRST EPSS, OSV).

Total
2
Critical
0
High
2
Medium
0
Low
0
Unscored
0
CISA KEV
0

Latest remix-run @remix-run/react CVEs

Newest publication first

  1. CVE-2026-21884 React Router SSR XSS in ScrollRestoration

    Published
    HighCVSS 8.2 EPSS 0.53%

    React Router is a router for React. In @remix-run/react version prior to 2.17.3. and react-router 7.0.0 through 7.11.0, a XSS vulnerability exists in in React Router's <ScrollRestoration> API in Framework Mode when using the getKey/storageKey props during Server-Side Rendering wh...

  2. CVE-2025-59057 React Router has XSS Vulnerability

    Published
    HighCVSS 7.6 EPSS 0.50%

    React Router is a router for React. In @remix-run/react versions 1.15.0 through 2.17.0. and react-router versions 7.0.0 through 7.8.2, a XSS vulnerability exists in in React Router's meta()/<Meta> APIs in Framework Mode when generating script:ld+json tags which could allow arbitr...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.