Post

We just published 6 CVEs identifying security vulnerabilities in React Router and Remix v2 We recommend updating to the latest appropriate versions: React Router v7 -- 7.12.0 React Router v6 -- 6.30.3 Remix v2 -- 2.17.2 Details, links, and package ranges are listed below

XSS via Meta component when generating script:ld+json tags github.com/remix-run/re... Framework Mode only Affected versions: - @​remix-run/react >=1.15.0, <=2.17.0 - react-router >=7.0.0, <=7.8.2

Unexpected external redirect via untrusted paths github.com/remix-run/re... Affected versions: - react-router >=6.0.0,<=6.30.1 - react-router >=7.0.0,<=7.9.5

CSRF in React Router Action/Server Action Request Processing github.com/remix-run/re... Framework Mode only Affected versions: - @​remix-run/server-runtime <=2.17.2 - react-router >=7.0.0,<=7.11.0

XSS via Open Redirects github.com/remix-run/re... Framework/Data mode only Affected versions: - @​remix-run/router <=1.23.1 - react-router >=7.0.0,<=7.11.0