Update dependency react-router to v7.18.0 [SECURITY]

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
react-router (source)	7.15.1 → 7.18.0

---

React Router: RSCErrorHandler Missing Protocol Validation (XSS)

CVE-2026-53667 / GHSA-h8fp-f39c-q6mh

More information

Details

This is a follow up to GHSA-8646-j5j9-6r62. React Router was alerted of a code path in the (unstable) RSC error handling path in which redirects from untrusted sources could still result in an XSS vector via attacker-supplied redirect targets

[!NOTE]
This only affects your application if you are using the unstable RSC APIs

Severity

• CVSS Score: 6.9 / 10 (Medium)
• Vector String: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:L/A:N

References

• https://github.com/remix-run/react-router/security/advisories/GHSA-h8fp-f39c-q6mh
• https://github.com/remix-run/react-router/pull/15177
• https://github.com/remix-run/react-router/commit/ce596e823f0d7b883a433af1d5a839a8b9fe0242
• https://github.com/remix-run/react-router/blob/main/CHANGELOG.md#v7180
• https://github.com/remix-run/react-router/releases/tag/react-router@7.18.0
• https://github.com/advisories/GHSA-h8fp-f39c-q6mh

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

React Router: Unauthenticated Denial of Service via Inefficient Route Matching

CVE-2026-55685 / GHSA-chx6-hx7r-mcp5

More information

Details

This is a follow up to GHSA-8x6r-g9mw-2r78 that covers additional reported scenarios in which the manifest endpoint could be accessed via unauthenticated targeted requests that would put heavy load on the server and slow down response times.

[!NOTE]
This only impacts Framework Mode applications. This does not impact your application if you are using Declarative or Data Mode.

Severity

• CVSS Score: 8.7 / 10 (High)
• Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

References

• https://github.com/remix-run/react-router/security/advisories/GHSA-chx6-hx7r-mcp5
• https://github.com/remix-run/react-router/pull/15186
• https://github.com/remix-run/react-router/commit/09e6020d1950e54f361f7ad00938ecd4dde60929
• https://github.com/remix-run/react-router/blob/main/CHANGELOG.md#v7180
• https://github.com/remix-run/react-router/releases/tag/react-router@7.18.0
• https://github.com/advisories/GHSA-chx6-hx7r-mcp5

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

React Router: Arbitrary Constructor Injection via deserializeErrors() in React Router SSR Hydration

CVE-2026-53666 / GHSA-337j-9hxr-rhxg

More information

Details

If application code allows attacker supplied input to overwrite certain aspects of errors caught by the SSR process, then it was possible for attacker to trigger unexpected constructor execution on the client which would trigger outbound network traffic. This is only possible with very specific (and unlikely) application layer code.

[!NOTE]
This does not impact your application if you are using Declarative Mode. This only impacts Framework Mode and Data Mode applications doing manual SSR/hydration

Severity

• CVSS Score: 6.1 / 10 (Medium)
• Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

References

• https://github.com/remix-run/react-router/security/advisories/GHSA-337j-9hxr-rhxg
• https://github.com/remix-run/react-router/pull/15175
• https://github.com/remix-run/react-router/commit/9d22943fd46c8ae4b08236425fa3549e10e9ad1a
• https://github.com/remix-run/react-router/blob/main/CHANGELOG.md#v7180
• https://github.com/remix-run/react-router/releases/tag/react-router@7.18.0
• https://github.com/advisories/GHSA-337j-9hxr-rhxg

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

React Router: Open redirect via backslash in and useNavigate (CVE-2025-68470 bypass)

CVE-2026-53669 / GHSA-wrjc-x8rr-h8h6

More information

Details

This is a follow up to CVE-2025-68470. React Router was alerted to certain scenarios in which the fix there was incomplete so there still existed some scenarios where attacker supplied paths passed to navigation mechanisms could result in unexpected external navigations.

Severity

• CVSS Score: 5.1 / 10 (Medium)
• Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:L/SI:L/SA:N

References

• https://github.com/remix-run/react-router/security/advisories/GHSA-wrjc-x8rr-h8h6
• https://github.com/remix-run/react-router/pull/15176
• https://github.com/remix-run/react-router/blob/main/CHANGELOG.md#v7180
• https://github.com/remix-run/react-router/releases/tag/react-router@7.18.0
• http://github.com/remix-run/react-router/pull/15176
• https://github.com/advisories/GHSA-wrjc-x8rr-h8h6

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Release Notes

remix-run/react-router (react-router)

v7.18.0

Compare Source

Patch Changes

• Fix server handler prerender responses when using ssr: false and future.v8_trailingSlashAwareDataRequests: true. Avoids false positive "SPA Mode" detection when serving prerendered paths (#​15173)
• Use the ServerRouter nonce for nonce-aware SSR components when they don't provide their own value so strict CSP pages can load them. (#​15170)
• Use turbo-stream to serialize and deserialize Framework Mode hydration errors (#​15175)
• Precompute route branch matchers to avoid recompiling route path regexes during matching (#​15186)
• Use the constructed request URL host when validating action request origins. (#​15185)
• Remove the un-documented custom error serialization logic from Data Mode SSR built-in hydration flows (#​15175)
• Validate protocols in RSC render redirects (#​15177)
• Consolidate url normalization logic and better handle mixed slashes (#​15176)

v7.17.0

Compare Source

Minor Changes

• Ship a subset of the official documentation inside the react-router package (#​15121)

  • Markdown docs are now available in node_modules/react-router/docs, letting AI coding agents and the React Router agent skills read official docs locally
  • Excludes auto-generated API docs (api/), community/ content, and tutorials (tutorials/)

v7.16.0

Compare Source

Minor Changes

• Stabilize future.unstable_trailingSlashAwareDataRequests as future.v8_trailingSlashAwareDataRequests (#​15098)

Patch Changes

• Disable manifest path when lazy route dicovery is disabled (#​15068)

• Fix browser URL creation to use the configured history window instead of the global window. (#​15066)

  • Pass the history/router window through to createBrowserURLImpl so custom window contexts keep the correct URL origin.

• Fix useNavigation() return type to preserve discriminated union across navigation states (#​15095)

• Widen MetaDescriptor script:ld+json type from LdJsonObject to LdJsonObject | LdJsonObject[] to permit multiple JSON-LD schemas in a single <script type="application/ld+json"> tag emitted by <Meta /> (#​15082)

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.