Описание
A flaw was found in React Router. An unauthenticated attacker can send targeted requests to the manifest endpoint, leading to a denial of service (DoS). This can put a heavy load on the server, significantly slowing down response times and impacting the availability of the application.
Отчет
React Router (npm packages react-router and @remix-run/server-runtime) versions 7.0.0 through 7.17.0 expose an unauthenticated manifest endpoint. Repeated, targeted requests to this endpoint place heavy load on the server and can degrade or deny service for other users. This issue is a follow-up to CVE-2026-42342 and is fixed upstream in react-router/@remix-run/server-runtime 7.18.0. This flaw only affects React Router's Framework Mode, applications that run a Node.js SSR server via @remix-run/server-runtime and serve the manifest endpoint. Applications using Declarative Mode () or Data Mode (createBrowserRouter/) do not run this server-side code path and are not affected. Simply bundling react-router does not by itself make a product exploitable; each console/UI component must be independently assessed by its owning team for Framework Mode usage and manifest endpoint exposure. Red Hat's CVSS score (6.5, CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) is lower than the CVE.org score because the affected React Router components in Red Hat products are used in internal console UIs that are deployed behind authenticated ingress, reducing the practical attack surface. This mirrors the same re-scoring applied to the predecessor flaw, CVE-2026-42342, for the same endpoint family.
Меры по смягчению последствий
Upgrade to react-router/@remix-run/server-runtime 7.18.0 or later once the fix is packaged in the affected Red Hat product. Where upgrading isn't immediately possible, rate-limiting or restricting access to the manifest endpoint at a reverse proxy or ingress layer can reduce exposure. Products that do not run React Router in Framework Mode (Declarative Mode or Data Mode only) are not affected regardless of the bundled react-router version.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Cryostat 4 | cryostat-openshift-console-plugin-npm | Not affected | ||
| Cryostat 4 | grafana-infinity-datasource-npm | Not affected | ||
| Cryostat 4 | react-router | Not affected | ||
| Exploit Intelligence | exploit-intelligence-tech-preview/agent-client-rhel9 | Affected | ||
| Gatekeeper 3 | gatekeeper/gatekeeper-rhel9 | Not affected | ||
| Migration Toolkit for Applications 8 | mta/mta-ui-rhel8 | Not affected | ||
| Migration Toolkit for Applications 8 | mta/mta-ui-rhel9 | Not affected | ||
| Migration Toolkit for Containers | rhmtc/openshift-migration-ui-rhel8 | Not affected | ||
| Migration Toolkit for Virtualization | migration-toolkit-virtualization/mtv-console-plugin-rhel9 | Not affected | ||
| Multicluster Engine for Kubernetes | multicluster-engine/console-mce-rhel9 | Not affected |
Показывать по
Ссылки на источники
Дополнительная информация
Статус:
EPSS
6.5 Medium
CVSS3
Связанные уязвимости
React Router is a router for React. In versions 7.0.0 through 7.17.0, the manifest endpoint could be accessed via unauthenticated targeted requests that would put heavy load on the server and slow down response times. This issue is a follow up to CVE-2026-42342, and does not does not impact React Router applications using Declarative Mode (<BrowserRouter>) or Data Mode (createBrowserRouter/<RouterProvider>). This issue has been fixed in version 7.18.0.
React Router: Unauthenticated Denial of Service via Inefficient Route Matching
EPSS
6.5 Medium
CVSS3