CVE-2026-42211: React Router is a router for React. In versions 7.0.0 through 7.14.1, when using Framework Mode, a combination of steps could potentially allow unauthorized…

PriorityP356high8.1CVSS 3.1

AVNACHPRNUINSUCHIHAH

EPSS

0.42%

33.3th percentile

React Router is a router for React. In versions 7.0.0 through 7.14.1, when using Framework Mode, a combination of steps could potentially allow unauthorized remote code execution (RCE) through external requests. This attack requires the application code to have an existing prototype pollution vulnerability, which can then be leveraged in a 2-step attack where the second step triggers unauthorized RCE on the remote server. This does not impact applications using Declarative Mode (``) or Data Mode (`createBrowserRouter/`). This is patched in version 7.14.2.

Affected

3 ranges

Vendor	Product	Version range	Fixed in
remix-run	react-router	—	—
remix-run	react-router	>= 7.0.0 < 7.14.2	7.14.2
shopify	react-router	>= 7.0.0 < 7.14.2	7.14.2

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.