CVE-2026-53666: 
React Router Analyse et atténuation des vulnérabilités

CVE-2026-53666 is an arbitrary constructor injection vulnerability in the deserializeErrors() function of React Router's Server-Side Rendering (SSR) hydration process. If application code allows attacker-supplied input to overwrite certain aspects of errors caught by the SSR process, an attacker can trigger unexpected constructor execution on the client, resulting in outbound network traffic. The vulnerability affects the react-router npm package versions >= 6.4.0 and < 7.18.0, and is patched in version 7.18.0. It carries a CVSS v3.1 base score of 6.1 (Medium), and is classified as CWE-470 (Unsafe Reflection). Importantly, this issue only affects Framework Mode and Data Mode applications performing manual SSR/hydration — Declarative Mode applications are not impacted (GitHub Advisory).

The root cause is CWE-470 (Use of Externally-Controlled Input to Select Classes or Code — Unsafe Reflection). The vulnerable deserializeErrors() function, used during SSR hydration, would attempt to reconstruct error objects by reading a __subType field from serialized error data and then looking up the corresponding constructor on the window object (e.g., window[val.__subType]). If attacker-controlled input could influence the serialized error payload (e.g., by setting __subType to an arbitrary class name like CustomError defined on window), the function would invoke that constructor, potentially triggering unintended side effects including outbound network requests. The fix, introduced in PR #15175, restricts deserialization to a whitelist of SUPPORTED_ERROR_TYPES and migrates Framework Mode hydration errors to use turbo-stream serialization, eliminating the unsafe reflection path entirely (GitHub Advisory, Fix PR, Fix Commit).

Successful exploitation can cause the victim's browser to initiate unintended outbound network requests, potentially leaking sensitive information (e.g., session tokens, page content) to attacker-controlled infrastructure. The scope is changed (cross-boundary), with low confidentiality and low integrity impact, and no availability impact. Exploitation requires a very specific application-layer code pattern where attacker input can influence SSR error serialization, making real-world impact limited but non-trivial for affected configurations (GitHub Advisory).

1. Identify a vulnerable target: Find a React Router application running in Framework Mode or Data Mode with manual SSR/hydration, using react-router >= 6.4.0 and < 7.18.0.
2. Locate attacker-controlled input in error handling: Identify application code that allows user-supplied data to influence the properties of errors caught during the SSR process — specifically, code that permits overwriting the __type or __subType fields of serialized error objects.
3. Craft a malicious error payload: Inject a payload into the error serialization path that sets __type to "Error" and __subType to the name of a constructor available on the window object (e.g., a custom class or built-in type) that, when instantiated, triggers a side effect such as an outbound network request.
4. Deliver the payload: Cause the victim's browser to load the SSR-rendered page containing the manipulated hydration data (e.g., via a crafted URL or by exploiting a separate injection point in the application).
5. Trigger constructor execution: During client-side hydration, deserializeErrors() reads the __subType field and calls window[val.__subType] as a constructor, executing the attacker-chosen code and initiating outbound network traffic to an attacker-controlled server (GitHub Advisory, Fix Commit).

• Network: Unexpected outbound HTTP/HTTPS requests from client browsers to unknown or attacker-controlled domains immediately following page load of SSR-rendered React Router pages.
• Logs: Server-side logs showing unusual or malformed error objects being serialized into SSR hydration data, particularly with unexpected __subType field values in the window.__staticRouterHydrationData.errors payload.
• Browser/Client: Presence of window.__staticRouterHydrationData with error entries containing __type: "Error" and a __subType value referencing a non-standard or custom constructor name; unexpected constructor names appearing in client-side error boundary output.

The primary remediation is to upgrade react-router to version 7.18.0 or later, which removes the unsafe deserializeErrors() logic and migrates Framework Mode hydration errors to use turbo-stream serialization with a strict allowlist of supported error types (GitHub Advisory, v7.18.0 Release). Applications using Declarative Mode are not affected and do not require immediate action. As a workaround for those unable to upgrade immediately, audit application code to ensure no user-supplied input can influence the __type or __subType fields of SSR error objects passed to the hydration layer.

Netlify published a changelog entry acknowledging the React Router security vulnerabilities, including CVE-2026-53666, on July 23, 2026 (Netlify Changelog). The vulnerability was reported by researcher yoyomiski and the fix was developed and merged by React Router core contributor brophdawg11 (GitHub Advisory). No broader social media discussion or significant community controversy has been observed.