{"cve":"CVE-2026-40181","nvd":{"published":"2026-06-02T20:16:35.597","modified":"2026-08-04T22:17:14.340","status":"Analyzed","description":"React Router is a router for React. In versions 7.0.0 through 7.14.0 and 6.7.0 through 6.30.3, certain URLs passed to the redirect function can trigger an open redirect to an external domain due to path values starting with // being reinterpreted as protocol-relative URLs. The level of impact depends on the validation done by the application prior to returning the redirect. This does not impact applications using Declarative Mode (<BrowserRouter>). This is patched in versions 7.14.1 and 6.30.4.","cvss_v4":{"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:U","score":6.6},"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","score":6.1},"cwes":["CWE-601"],"references":["https://github.com/remix-run/react-router/security/advisories/GHSA-2j2x-hqr9-3h42"],"products":["shopify:react-router"],"source":"nvd","synced_at":"2026-10-19T22:37:48.043517290+00:00"},"epss":{"cve":"CVE-2026-40181","score":0.00221,"percentile":0.12723,"date":"2026-10-31"},"kev":null,"osv":[{"id":"GHSA-2j2x-hqr9-3h42","url":"https://osv.dev/vulnerability/GHSA-2j2x-hqr9-3h42","summary":"React Router's same-origin redirect with path starting // causes open redirect via protocol-relative URL reinterpretation","modified":"2026-09-10T03:50:55.348600076Z","packages":[{"ecosystem":"npm","name":"react-router","purl":"pkg:npm/react-router","ranges":[">=7.0.0 <7.14.1"],"fixed":["7.14.1"]},{"ecosystem":"npm","name":"react-router","purl":"pkg:npm/react-router","ranges":[">=6.7.0 <6.30.4"],"fixed":["6.30.4"]},{"ecosystem":"npm","name":"@remix-run/router","purl":"pkg:npm/%40remix-run/router","ranges":[">=1.3.0 <1.23.3"],"fixed":["1.23.3"]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}