CVE-2026-55685: 
React Router Analyse et atténuation des vulnérabilités

CVE-2026-55685 is a Denial of Service vulnerability in the react-router npm package (Framework Mode) caused by inefficient route matching when processing unauthenticated requests to the manifest endpoint (/__manifest). It is a follow-up to GHSA-8x6r-g9mw-2r78, covering additional scenarios where crafted requests to the manifest endpoint generate excessive server load and degrade response times. Affected versions are react-router >= 7.0.0, < 7.18.0; the vulnerability does not affect applications using Declarative or Data Mode. It carries a CVSS v4.0 base score of 8.7 (High) (GitHub Advisory).

The root cause is classified under CWE-400 (Uncontrolled Resource Consumption) and CWE-407 (Inefficient Algorithmic Complexity). In Framework Mode, the /__manifest endpoint accepts a paths query parameter and performs route matching for each supplied path — including recompiling route path regular expressions on every request rather than using precomputed matchers. An unauthenticated attacker can craft targeted HTTP requests with deeply nested or numerous path segments, triggering worst-case algorithmic complexity in the route matching logic and causing significant CPU load on the server. The fix (commit 09e6020) precomputes route branch matchers at startup, enforces a URL length limit (URL_LIMIT = 7680 bytes) returning HTTP 400 for oversized requests, and adds ancestor-path deduplication via getPathsWithAncestors() (GitHub Advisory, Fix Commit).

Successful exploitation degrades server availability by consuming excessive CPU resources during route matching, slowing or blocking legitimate responses for all users of the affected application. The impact is limited to availability — there is no confidentiality or integrity impact, and subsequent systems are not affected. Only React Router Framework Mode applications (versions 7.0.0–7.17.x) are vulnerable; Declarative and Data Mode deployments are unaffected (GitHub Advisory).

1. Reconnaissance: Identify internet-facing web applications running React Router in Framework Mode (versions 7.0.0–7.17.x) by probing for the /__manifest endpoint, which is publicly accessible without authentication.
2. Craft malicious request: Construct an HTTP GET request targeting /__manifest with a paths query parameter containing deeply nested or numerous path segments (e.g., /__manifest?paths=%2Fa%2Fb%2Fc%2Fd%2F...&version=<version>) designed to maximize route matching iterations.
3. Send high-volume requests: Repeatedly send these crafted requests to the manifest endpoint without any authentication, causing the server to recompile route path regular expressions and perform expensive matching operations on each request.
4. Achieve denial of service: The cumulative CPU load from concurrent or rapid requests degrades server response times, potentially rendering the application unavailable to legitimate users (GitHub Advisory, Fix Commit).

• Network: High volume of HTTP GET requests to /__manifest (or custom manifest path) from one or more source IPs, particularly with long or deeply nested paths query parameters exceeding normal application usage patterns.
• Logs: Web server or application access logs showing repeated requests to /__manifest?paths=... with unusually long query strings or high request rates; HTTP 400 responses to oversized manifest requests (post-patch indicator of attempted exploitation).
• Process/Performance: Sustained high CPU utilization on the Node.js server process correlating with spikes in manifest endpoint traffic; increased response latency or timeouts for legitimate application requests during the attack window.

Upgrade react-router to version 7.18.0 or later, which precomputes route matchers, enforces a URL length limit (returning HTTP 400 for requests exceeding 7,680 characters), and deduplicates ancestor paths to eliminate the inefficient algorithmic behavior (GitHub Advisory, v7.18.0 Release). As a temporary workaround prior to patching, consider placing a reverse proxy or WAF in front of the application configured to rate-limit or block requests to the /__manifest endpoint from untrusted sources. Applications using Declarative or Data Mode do not require any action.

Netlify published a changelog entry on July 23, 2026 acknowledging the React Router security vulnerabilities, indicating platform-level awareness and response (Netlify Changelog). The vulnerability was reported by researcher dinhvaren and credited in the GitHub Advisory. No significant broader media coverage or notable social media discussion has been identified beyond the advisory and platform notifications.