GHSA-337j-9hxr-rhxg

Suggest an improvement
Source
https://github.com/advisories/GHSA-337j-9hxr-rhxg
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/07/GHSA-337j-9hxr-rhxg/GHSA-337j-9hxr-rhxg.json
JSON Data
https://api.test.osv.dev/v1/vulns/GHSA-337j-9hxr-rhxg
Aliases
Downstream
CGA (21)
MINI (1)
Published
2026-07-23T19:34:14Z
Modified
2026-07-23T19:56:40Z
Severity
  • 6.1 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N CVSS Calculator
Summary
React Router: Arbitrary Constructor Injection via deserializeErrors() in React Router SSR Hydration
Details

If application code allows attacker supplied input to overwrite certain aspects of errors caught by the SSR process, then it was possible for attacker to trigger unexpected constructor execution on the client which would trigger outbound network traffic. This is only possible with very specific (and unlikely) application layer code.

[!NOTE] This does not impact your application if you are using Declarative Mode. This only impacts Framework Mode and Data Mode applications doing manual SSR/hydration

Database specific 
{
    "cwe_ids": [
        "CWE-470"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-07-23T19:34:14Z",
    "nvd_published_at": null,
    "severity": "MODERATE"
}
References

Affected packages

npm / react-router

Package

Name
react-router
View open source insights on deps.dev
Purl
pkg:npm/react-router

Affected ranges

Type
SEMVER
Events
Introduced
6.4.0
Fixed
7.18.0

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/07/GHSA-337j-9hxr-rhxg/GHSA-337j-9hxr-rhxg.json"