CVE-2026-42342 React Router vulnerable to DoS via unbounded path expansion in __manifest endpoint
Crafted requests cause resource exhaustion in React Router Framework Mode, leading to service unavailability; upgrade to patched versions.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-42342?
CVE-2026-42342 is a high-severity denial of service vulnerability in @remix-run/server-runtime, published on 2 Jun 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
React Router is a router for React. In versions 7.0.0 through 7.14.x of react-router and versions 2.10.0 through 2.17.4 of @remix-run/server-runtime, certain crafted requests can consume disproportionate server resources via unbounded path expansion in the __manifest endpoint, resulting in response time degradation and/or service unavailability for end users. This affects React Router Framework Mode applications as well as Remix applications. This does not impact applications using Declarative Mode (`<BrowserRouter>`) or Data Mode (`createBrowserRouter/<RouterProvider>`). This is patched in react-router version 7.15.0 and @remix-run/server-runtime version 2.17.5.
Weakness: CWE-400
Which versions are affected by CVE-2026-42342?
4 open source packages ship an affected version, including @remix-run/server-runtime and react-router. It affects 2 products.
| Package | Affected | Fixed in |
|---|---|---|
@remix-run/server-runtime npm | From 2.10.0 | 2.17.5 |
@remix-run/server-runtime npm | From 2.10.0 | 2.17.5 |
react-router npm | From 7.0.0 | 7.15.0 |
react-router npm | From 7.0.0 | 7.15.0 |
Products include Shopify React-Router, Shopify Remix-Run\/Server-Runtime.
How do I fix CVE-2026-42342?
Upgrade @remix-run/server-runtime to 2.17.5 or later.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-42342 being exploited?
There is no known exploitation of CVE-2026-42342 in the wild and no public exploit code.
Other vulnerabilities in @remix-run/server-runtime
- CVE-2026-55685 React Router: Unauthenticated Denial of Service via Inefficient Route Matching
- CVE-2026-21884 React Router SSR XSS in ScrollRestoration
- CVE-2026-42211 React Router's vendored turbo-stream v2 allows arbitrary constructor invocation via TYPE_ERROR deserialization leading to Unauth RCE
- CVE-2026-33245 React Router vulnerable to XSS in unstable RSC redirect handling via javascript: redirect targets
- CVE-2026-22029 React Router vulnerable to XSS via Open Redirects
Sources
Also known as CLSA-2026-1784943129, CLSA-2026-1789118116, CLSA-2026-1792160940, CLSA-2026-1792253399, CLSA-2026-1792279965, CLSA-2026-1792419114 and 11 more.