Stored XSS via unescaped Location header in prerendered redirect HTML Framework Mode with Pre-rendering only Affected versions: - react-router >=7.5.1,<7.13.2

DoS via unbounded path expansion in __manifest endpoint Framework Mode & Remix v2 Affected versions: - @remix-run/server-runtime >=2.10.0,<2.17.5 - react-router >=7.0.0,<7.15.0

XSS in unstable RSC redirect handling via javascript: redirect targets Unstable RSC APIs only Affected versions: - react-router >=7.7.0,<7.13.2

Potential RCE via 2-step attack chained onto existing prototype pollution vulnerability Framework Mode only Affected versions: - react-router >= 7.0.0,<= 7.14.1

Same-origin redirect with path starting // causes open redirect via protocol-relative URL reinterpretation Framework & Data Mode Affected versions: - react-router >=7.0.0,<7.14.1 - react-router…

We just published 7 CVEs identifying security vulnerabilities in React Router and Remix v2 We recommend updating to the latest appropriate versions: - React Router v7 -- 7.16.0 - React Router v6 --…

Potential CSRF via PUT/PATCH/DELETE document requests Framework Mode only Affected versions: - @remix-run/server-runtime >=2.17.3,<2.17.5 - react-router >=7.12.0,<7.15.1

It’s a bit more complicated because we can’t just leverage link prefetch, but nothing crazy. Just have to settle on the right user facing API from a couple options we’ve kicked around. Just hasn’t…

1⃣5⃣React Redux The official library for using Redux with React, makes state management easier.