CVE-2026-55685

High

Description

React Router is a router for React. In versions 7.0.0 through 7.17.0, the manifest endpoint could be accessed via unauthenticated targeted requests that would put heavy load on the server and slow down response times. This issue is a follow up to CVE-2026-42342, and does not does not impact React Router applications using Declarative Mode (<BrowserRouter>) or Data Mode (createBrowserRouter/<RouterProvider>). This issue has been fixed in version 7.18.0.

SeverityHigh

CVSS7.5

Exploit probability—

Product

Shopify React-router

PublishedJul 27, 2026

First seenJul 27, 2026

Weakness typeCWE-400Uncontrolled resource consumption CWE-407CWE-407

How to fix

Update

shopify react-router7.18.0 or later
react-router7.18.0 or later

Affected products

Product	Affected versions	Fixed in
shopify react-router	7.0.0 ≤ v < 7.18.0	7.18.0
react-routernpm	7.0.0 ≤ v < 7.18.0	7.18.0

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.