CVE-2026-42342: React Router and Remix __manifest Denial of Service Vulnerability

Technical summary

The vulnerability stems from inadequate resource constraints on path expansion processing in the __manifest endpoint of React Router Framework Mode (versions 7.0.0–7.14.x) and @remix-run/server-runtime (versions 2.10.0–2.17.4). When an attacker sends requests with crafted path parameters, the server processes unbounded path expansion without proper limits, consuming CPU and memory resources disproportionately. The flaw manifests as CWE-400 (Uncontrolled Resource Consumption), allowing attackers to degrade service availability. Patched versions impose proper bounds on path expansion logic. Applications using Declarative Mode (<BrowserRouter>) or Data Mode (createBrowserRouter/<RouterProvider>) are not affected because they do not utilize the vulnerable __manifest endpoint processing in the same manner.

Business impact

Availability impact is the primary concern. A successful attack can degrade application responsiveness or cause complete service outages, directly affecting end-user experience and business continuity. E-commerce, SaaS platforms, and content delivery applications relying on affected React Router or Remix deployments face revenue loss, reputational damage, and support overhead during an active attack. The attack requires no authentication or user interaction, making it accessible to opportunistic threat actors and increasing incident likelihood.

Affected systems

Affected: React Router versions 7.0.0 through 7.14.x; @remix-run/server-runtime versions 2.10.0 through 2.17.4. Only Framework Mode applications are vulnerable; Declarative Mode and Data Mode applications are unaffected. Organizations using these routing patterns in production should prioritize identification of affected instances. Verify your application's routing configuration and installed package versions in package.json and package-lock.json or yarn.lock files.

Exploitability

Exploitability is high. The attack vector is network-based, requires no authentication or privilege, and involves minimal complexity—a straightforward HTTP request with crafted path parameters. No user interaction is required. The CVSS 3.1 score of 7.5 reflects this accessibility. No active exploit code has been reported in the wild (KEV status: not included), but the technical barrier to weaponization is low, and the attack can be executed from any internet-connected host. Organizations should assume potential hostile interest as awareness spreads.

Remediation

Update react-router to version 7.15.0 or later and @remix-run/server-runtime to version 2.17.5 or later. Verify against the official Shopify/Remix advisories for complete patch notes and any post-update validation steps. For organizations unable to patch immediately, implement network-level rate limiting and request filtering on the __manifest endpoint to reduce blast radius, though this is not a substitute for patching. Applications already using Declarative or Data Mode routing require no changes.

Patch guidance

Apply patches to react-router (to 7.15.0+) and @remix-run/server-runtime (to 2.17.5+) in development and staging environments first to validate compatibility with your application dependencies and custom configurations. Check for any breaking changes in the patch release notes. Update both direct and transitive dependencies. After deployment to production, monitor application logs and performance metrics for anomalies. If your build system or CI/CD pipeline pins versions, ensure those constraints are updated to allow the patched versions.

Detection guidance

Monitor for HTTP requests targeting the __manifest endpoint with unusual path parameters or exceptionally long path strings. Alert on sudden increases in CPU or memory consumption correlated with specific request patterns. Implement request logging that captures full paths and sizes. Network intrusion detection systems should be tuned to flag repeated requests with suspicious path expansion payloads. Baseline your normal __manifest request patterns and deviation detection will help identify exploitation attempts before they cause service degradation.

Why prioritize this

Despite not being on the Known Exploited Vulnerabilities (KEV) list, this vulnerability merits immediate prioritization due to its high CVSS score (7.5), low attack complexity, unauthenticated access requirement, and direct impact on service availability. Any internet-facing React Router Framework Mode or Remix application is at immediate risk. The technical simplicity of exploitation and the broad attack surface (any unauthenticated user) elevate business risk regardless of KEV status.

Risk score, explained

The CVSS 3.1 score of 7.5 (HIGH) reflects a network-accessible denial-of-service vulnerability with no authentication or user interaction barriers. The vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H indicates: network attack vector, low attack complexity, no privileges or user interaction required, and high availability impact. While confidentiality and integrity are not compromised, the availability impact alone justifies the HIGH severity rating and warrants prompt remediation.

Frequently asked questions