React Router 7.18 Fixes Two Bugs Its Own Patches Missed

React Router 7.18.0 patches five vulnerabilities, and two of them are second attempts: a denial-of-service fix and an open-redirect fix that each replace an earlier patch which didn’t fully close the hole. Netlify, which hosts React Router and Remix apps but doesn’t maintain the framework, flagged the release to customers in a changelog entry on July 23, 2026, telling them to upgrade (Netlify changelog, July 23, 2026).

---

What changed

The more severe repeat is CVE-2026-55685, a CVSS 8.7 denial-of-service bug in React Router’s __manifest endpoint. A single unauthenticated request with a deep, attacker-controlled path can trigger expensive synchronous route matching that blocks the Node.js event loop, taking down the whole process rather than just one request. It’s an explicit follow-up to CVE-2026-42342, a nearly identical manifest-endpoint DoS that React Router had already patched in 7.15.0 on June 2, 2026. The new advisory extends coverage to unstable RSC framework mode, which the first fix didn’t cover; only Framework Mode apps using SSR are exposed, not Declarative or Data Mode (GitHub Security Advisory, react-router manifest DoS).

The second repeat is CVE-2026-53669, an open redirect reachable by passing a backslash-prefixed path to <Link> or useNavigate, which browsers can reinterpret as a protocol-relative URL and follow off-site. GitHub’s advisory calls it directly: a bypass of CVE-2025-68470, a 2025 fix for the same code path that turned out to be incomplete (GitHub Security Advisory GHSA-wrjc-x8rr-h8h6).

A third fix, CVE-2026-53666, is new rather than a repeat: a moderate-severity constructor-injection bug in SSR hydration, where a crafted __subType field in a serialized error can get instantiated against the client’s global window object during deserializeErrors(). It’s scoped to apps doing manual SSR/hydration in Framework or Data Mode (GitHub Security Advisory GHSA-337j-9hxr-rhxg). All three, plus two more the Netlify changelog lists alongside them, are closed in React Router 7.18.0.

---

Why this matters

A patch that gets bypassed once is a fact of security work. Attackers and researchers probe harder than any one release cycle can anticipate. Two bypasses landing in the same release, against the two riskiest bug classes the framework has had this year, is not a coincidence. Both original fixes (7.15.0 for the DoS, the 2025 patch for the redirect) were scoped too narrowly to the exact reproduction that triggered them, not the underlying class of input the router treats as safe.

For teams running React Router in Framework Mode, that means version-pinning to 7.18.0 isn’t a one-time fire drill; it’s a reason to assume this pair of code paths (path parsing into navigation APIs, and manifest-endpoint route matching) will keep drawing scrutiny. Netlify carrying the customer notice, as it did for a separate Next.js security release just two weeks earlier (Firerun, July 26, 2026), is becoming the routine, not the exception: a host’s changelog is often where developers learn a framework they didn’t write needs a same-day upgrade.

Key Takeaways

• React Router 7.18.0, released around July 22, 2026, fixes five vulnerabilities; two are explicit bypasses of earlier 2026 patches.
• CVE-2026-55685 (CVSS 8.7) is a second manifest-endpoint DoS fix, extending June’s 7.15.0 patch to cover unstable RSC framework mode.
• CVE-2026-53669 is a second fix for backslash-based open redirects, following a 2025 patch GitHub says was incomplete.
• Netlify’s changelog, not React Router’s own release notes, is where many hosted customers will see the upgrade notice first.