{"cve":"CVE-2026-55685","nvd":{"published":"2026-07-27T22:17:40.860","modified":"2026-10-24T13:10:00.147","status":"Analyzed","description":"React Router is a router for React. In versions 7.0.0 through 7.17.0, the manifest endpoint could be accessed via unauthenticated targeted requests that would put heavy load on the server and slow down response times. This issue is a follow up to CVE-2026-42342, and does not does not impact React Router applications using Declarative Mode (<BrowserRouter>) or Data Mode (createBrowserRouter/<RouterProvider>). This issue has been fixed in version 7.18.0.","cvss_v4":{"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","score":8.7},"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","score":7.5},"cwes":["CWE-400","CWE-407"],"references":["https://github.com/remix-run/react-router/blob/main/CHANGELOG.md#v7180","https://github.com/remix-run/react-router/commit/09e6020d1950e54f361f7ad00938ecd4dde60929","https://github.com/remix-run/react-router/pull/15186","https://github.com/remix-run/react-router/releases/tag/react-router@7.18.0","https://github.com/remix-run/react-router/security/advisories/GHSA-8x6r-g9mw-2r78"],"products":["shopify:react-router"],"source":"nvd","synced_at":"2026-10-24T16:53:27.712498749+00:00"},"epss":{"cve":"CVE-2026-55685","score":0.00708,"percentile":0.53195,"date":"2026-10-25"},"kev":null,"osv":[{"id":"GHSA-chx6-hx7r-mcp5","url":"https://osv.dev/vulnerability/GHSA-chx6-hx7r-mcp5","summary":"React Router: Unauthenticated Denial of Service via Inefficient Route Matching","modified":"2026-09-10T03:51:11.397587276Z","packages":[{"ecosystem":"npm","name":"react-router","purl":"pkg:npm/react-router","ranges":[">=7.0.0 <7.18.0"],"fixed":["7.18.0"]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}