CVE-2026-53669: 
React Router Analyse et atténuation des vulnérabilités

CVE-2026-53669 is an open redirect vulnerability in the react-router npm package, described as a bypass of the incomplete fix for CVE-2025-68470. Attacker-supplied paths passed to React Router navigation mechanisms (such as <Link> and useNavigate) can result in unexpected external navigations due to insufficient URL normalization. It affects react-router versions >= 6.0.0 and < 7.18.0, with version 7.18.0 containing the patch. The vulnerability was published on July 23, 2026, and carries a CVSS v4.0 base score of 5.1 (Medium) (Github Advisory).

The root cause is classified as CWE-601 (URL Redirection to Untrusted Site / Open Redirect), stemming from incomplete URL normalization logic in React Router's navigation handling. The prior fix for CVE-2025-68470 failed to account for certain path patterns — specifically, mixed slash/backslash sequences (e.g., \, \/, /\) — that browsers interpret as external navigations. The fix in PR #15176 consolidated URL normalization logic and introduced stricter regex-based detection of absolute and protocol-relative URLs (ABSOLUTE_URL_REGEX and PROTOCOL_RELATIVE_URL_REGEX) to block these bypass patterns (Github Advisory, React Router PR). No privileges are required, and exploitation requires active user interaction (e.g., a user clicking a crafted link).

Successful exploitation allows an unauthenticated attacker to redirect users from a trusted React Router application to an attacker-controlled external site, enabling phishing, credential harvesting, or malware delivery. The integrity of the vulnerable system is marginally affected (unauthorized navigation), and downstream/subsequent systems may experience low confidentiality and integrity impacts if users are deceived into submitting sensitive information to attacker-controlled destinations. There is no direct impact on availability or confidentiality of the application itself (Github Advisory).

1. Identify target application: Locate a web application using react-router npm versions >= 6.0.0 and < 7.18.0 that passes user-controlled input to navigation mechanisms such as <Link to={userInput}> or useNavigate(userInput).
2. Craft a malicious path: Construct a path using backslash or mixed slash sequences that bypass the incomplete URL normalization, for example: \\attacker.com, \/attacker.com, or /\attacker.com.
3. Deliver the payload: Embed the crafted path in a URL or link within the application (e.g., via a query parameter, user profile field, or redirect parameter) that is rendered by a <Link> component or passed to useNavigate().
4. Trigger user interaction: Socially engineer the target user into clicking the crafted link within the trusted application context.
5. Achieve redirect: The browser interprets the backslash-containing path as an external URL and navigates the user to the attacker-controlled site, where phishing or further attacks can be conducted (Github Advisory, React Router PR).

• Network: Outbound HTTP/HTTPS requests from user browsers to unexpected external domains immediately following interaction with a React Router application; referrer headers in attacker server logs showing the legitimate application's origin domain.
• Logs: Application or CDN access logs showing navigation requests containing backslash sequences (e.g., \\, \/, /\) in path or query parameters passed to routing endpoints.
• Application Behavior: User reports of being unexpectedly redirected to external sites after clicking internal links within the application.

Upgrade react-router to version 7.18.0 or later, which consolidates URL normalization logic and correctly blocks backslash-based open redirect bypasses (Github Advisory, v7.18.0 Release). As a workaround for applications that cannot immediately upgrade, developers should implement strict server-side and client-side validation of any user-supplied paths before passing them to navigation mechanisms, ensuring only known internal routes are accepted. Additionally, audit all usages of <Link>, useNavigate(), and similar APIs to confirm they do not accept unvalidated external input.

Netlify published a changelog entry on July 23, 2026 acknowledging the React Router security vulnerabilities, indicating awareness among major hosting providers of the React ecosystem (Netlify Changelog). The vulnerability was reported by a researcher credited as "outring" in the GitHub advisory. Community discussion in the fix PR noted that the regex used in the patch (/^[\\]{2}/i) permits mixed slash/backslash combinations, prompting a follow-up question from reviewer "matijs" about whether this was intentional — the maintainer confirmed it was (React Router PR).