React Router vulnerable to DoS via unbounded path expansion in __manifest endpoint

Description

There exists a potential DOS attack vector in React Router Framework Mode applications (as well as Remix v2.10.0 - 2.17.4). Certain requests can be crafted to consume disproportionate resources on the server, resulting in response time degredation and/or service unavailability for end users.

Recommendation

Update the @remix-run/server-runtime package to the latest compatible version. Followings are version details:

• Affected version(s): >= 2.10.0, < 2.17.5
• Patched version(s): 2.17.5

References

• GHSA-8x6r-g9mw-2r78
• CVE-2026-42342
• CWE-400
• CAPEC-310
• OWASP 2021-A6

Related Issues

• React Router: Potential CSRF via PUT/PATCH/DELETE document requests - CVE-2026-53663
• React Router vulnerable to Denial of Service via reflected user input in single-fetch - CVE-2026-34077
• path-to-regexp vulnerable to Regular Expression Denial of Service via multiple wildcards - CVE-2026-4923
• lodash vulnerable to Prototype Pollution via array path bypass in `_.unset` and `_.omit` - lodash-es - CVE-2026-2950

You might also like:

Apache and Express Path Traversal plus Nginx Restriction Bypass Tests with SmartScanner

CSRF, XXE, and 12 Other Security Acronyms Explained

Update Cheat Sheet for Developers

Tags:

npm

@remix-run/server-runtime