CVE-2026-34077: React Router XSS in RSC Redirect Handling – Patch Guidance

Technical summary

The vulnerability exists in React Router's handling of redirects within the experimental React Server Components feature set. When redirect destinations originate from untrusted input—such as user-supplied query parameters or external data—insufficient sanitization allows arbitrary JavaScript injection into the client-side redirect execution flow. The flaw is specific to RSC implementations and does not impact traditional React Router routing patterns. CWE-770 classification indicates an uncontrolled resource consumption concern, though the primary manifestation is XSS. Exploitation requires both that an application uses the unstable RSC APIs and that it passes unsanitized redirect values to the affected code paths.

Business impact

Organizations using React Router for server-rendered React applications face potential account compromise, session hijacking, and credential theft if attackers can craft malicious redirect URLs. Affected users may be tricked into visiting attacker-controlled content or have sensitive browser data exfiltrated. For SaaS platforms and internal web applications, this creates direct exposure to phishing-style attacks that appear to originate from legitimate application redirects. Remediation requires swift patching, particularly for customer-facing applications where trust and data security are critical.

Affected systems

React Router versions 7.7.0 through 7.13.1 are affected when the unstable React Server Components APIs are in use. The vulnerability does not impact applications using React Router's standard, stable routing APIs. Turbo Stream packages that depend on vulnerable React Router versions may also require attention depending on their specific dependencies and usage patterns. Organizations should audit their React Router version and confirm whether RSC APIs are actively enabled in their application configuration.

Exploitability

Exploitation requires an attacker to control or influence redirect destinations that flow through React Router's RSC handling. Attack vectors include manipulating query parameters, intercepting redirect logic, or compromising upstream redirect sources. No user interaction beyond following a crafted link is necessary (CVSS vector: AV:N/AC:L/PR:N/UI:N). However, the attacker must have knowledge that the target application uses unstable RSC APIs, which may limit opportunistic exploitation. The vulnerability is not known to be actively exploited in the wild at this time.

Remediation

Update React Router to version 7.13.2 or later. Applications using Turbo Stream should verify their React Router transitive dependency is updated. For environments where immediate patching is infeasible, disable or avoid using the unstable RSC APIs until patches are deployed. Input validation and output encoding on redirect destinations provide defense-in-depth but should not be relied upon as a substitute for patching. Test patched versions in development and staging environments before production deployment.

Patch guidance

Shopify released React Router 7.13.2 on or around the vulnerability publication date (2026-06-02). Update your package.json dependency or equivalent package manager configuration to reference version 7.13.2 or any later 7.x release. Run npm update (or equivalent for your package manager) and verify the upgrade in your lockfile. If your application depends on Turbo Stream, ensure its React Router transitive dependency resolves to the patched version. Recompile and redeploy your application, paying particular attention to server-side rendering and RSC initialization paths.

Detection guidance

Review application code to identify whether React Router's unstable RSC APIs are imported or used (e.g., functions marked with 'unstable_' prefix). Check package-lock.json or yarn.lock for React Router versions 7.7.0–7.13.1. Monitor web server logs and application error tracking for unexpected 30x redirect responses or JavaScript errors originating from redirect handling. Implement Content Security Policy (CSP) headers to restrict inline script execution and reduce XSS impact. Conduct manual code review of any redirect-handling logic that processes external input.

Why prioritize this

This vulnerability merits high priority for organizations using React Router with RSC features because it enables direct client-side code injection with minimal barriers to exploitation. The CVSS 7.5 score reflects the network-accessible nature and lack of authentication requirements. While exploit activity is not yet widespread, the straightforward nature of XSS attacks and the potential for account takeover justify swift remediation. Teams should prioritize patching before expanding RSC usage in production or handling sensitive user data through redirect flows.

Risk score, explained

CVSS 3.1 score of 7.5 (HIGH severity) is derived from a network-accessible attack vector (AV:N), low attack complexity (AC:L), and no privilege or user interaction requirements (PR:N/UI:N). However, the vector indicates 'A:H' (Availability impact High) rather than Integrity impact, which is atypical for an XSS vulnerability. This may reflect the underlying CWE-770 resource exhaustion concern or a conservative scoring approach. The practical business risk—unpatched XSS in a web framework—is well-captured by the HIGH severity rating. Security teams should apply their own organizational risk context; applications handling authentication or payment data warrant immediate patching even if other factors are mitigating.

Frequently asked questions