CVE-2026-40181

React Router is a router for React. In versions 7.0.0 through 7.14.0 and 6.7.0 through 6.30.3, certain URLs passed to the redirect function can trigger an open redirect to an external domain due to path values starting with // being reinterpreted as protocol-relative URLs. The level of impact depends on the validation done by the application prior to returning the redirect. This does not impact applications using Declarative Mode (<BrowserRouter>). This is patched in versions 7.14.1 and 6.30.4.

Database specific

{
    "cna_assigner": "GitHub_M",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/40xxx/CVE-2026-40181.json",
    "cwe_ids": [
        "CWE-601"
    ]
}

References

Affected packages

Git / github.com/remix-run/react-router

Affected ranges

Type

GIT

Repo

https://github.com/remix-run/react-router

Events

Introduced

74979cb5f84092d83adcf5cda5bf281b3450683c

Fixed

72973b6493d27014aa76a23a95e3ca186616c4fd

Introduced

e8e3b004d94a949372e77ce97a543bff5bc6fb89

Fixed

197674ba9fc1b72b452e17894e5e783bdab7a087

Database specific

{
    "source": "CPE_RANGE",
    "extracted_events": [
        {
            "introduced": "6.7.0"
        },
        {
            "fixed": "6.30.4"
        },
        {
            "introduced": "7.0.0"
        },
        {
            "fixed": "7.14.1"
        }
    ],
    "cpe": "cpe:2.3:a:shopify:react-router:*:*:*:*:*:node.js:*:*"
}

Database specific

source

"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-40181.json"