Description
There exists a potential DOS attack vector in React Router Framework Mode applications (as well as Remix v2.10.0 - 2.17.4). Certain requests can be crafted to consume disproportionate resources on the server, resulting in response time degredation and/or service unavailability for end users.
Recommendation
Update the @remix-run/server-runtime package to the latest compatible version. Followings are version details:
- Affected version(s): >= 2.10.0, < 2.17.5
- Patched version(s): 2.17.5
References
Could your website be exposed too?
SmartScanner can check your website for React Router vulnerable to DoS via unbounded path expansion in __manifest endpoint and gives you actionable findings to investigate.
Start a free scanRelated Issues
- React Router: Potential CSRF via PUT/PATCH/DELETE document requests - CVE-2026-53663
- React Router vulnerable to Denial of Service via reflected user input in single-fetch - CVE-2026-34077
- path-to-regexp vulnerable to Regular Expression Denial of Service via multiple wildcards - CVE-2026-4923
- lodash vulnerable to Prototype Pollution via array path bypass in `_.unset` and `_.omit` - lodash-es - CVE-2026-2950
You might also like:
See something that needs correcting? Let us knowUpdated June 03, 2026