CVE-2026-21884: 
JavaScript vulnerability analysis and mitigation

CVE-2026-21884 is a Cross-Site Scripting (XSS) vulnerability in React Router's ScrollRestoration API, specifically affecting applications using Framework Mode with Server-Side Rendering (SSR). The flaw allows arbitrary JavaScript execution during SSR when untrusted content is used to generate getKey or storageKey props. It was disclosed on January 8, 2026, via a GitHub Security Advisory, and published to the NVD on January 10, 2026. Affected versions include react-router 7.0.0–7.11.0 (and 7.12.0 in some sources) and @remix-run/react prior to 2.17.3. It carries a CVSS v3.1 base score of 8.2 (High) (GitHub Advisory, React Router Advisory).

The root cause is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation — Cross-Site Scripting). The vulnerability exists in the ScrollRestoration component's getKey and storageKey props: when these props are populated with untrusted, user-controlled input during server-side rendering in Framework Mode, the values are rendered into the HTML output without proper sanitization, enabling injection of arbitrary JavaScript. Exploitation requires no privileges and low attack complexity, but does require user interaction (e.g., a victim visiting a crafted URL or page). Applications using Declarative Mode (<BrowserRouter>) or Data Mode (createBrowserRouter/<RouterProvider>), or those with SSR disabled, are not affected (GitHub Advisory, React Router Advisory).

Successful exploitation can result in high confidentiality impact and low integrity impact, with no availability impact. An unauthenticated remote attacker who tricks a user into visiting a malicious page can execute arbitrary JavaScript in the victim's browser context during SSR, potentially accessing sensitive data rendered server-side, stealing session tokens, or performing actions on behalf of the user. Multiple IBM products that bundle React Router or Remix are also affected, broadening the potential attack surface to enterprise environments including IBM Cloud Pak for Automation, IBM API Connect, IBM watsonx, and IBM Carbon Charts (GitHub Advisory, Feedly).

No public proof-of-concept exploit code has been identified, and there is no evidence of in-the-wild exploitation at this time. The EPSS score is approximately 0.041% (0.00041), indicating a low near-term exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Detection plugins are available via Nessus (plugin 282620) and Qualys (plugin 151074) (GitHub Advisory, Feedly).

1. Reconnaissance: Identify web applications built with React Router 7.0.0–7.11.0 or @remix-run/react < 2.17.3 that use Framework Mode with SSR enabled and render the <ScrollRestoration> component with user-controlled getKey or storageKey props.
2. Craft malicious input: Prepare a payload that injects JavaScript into the getKey or storageKey value, for example: storageKey="</script><script>alert(document.cookie)</script>".
3. Deliver the payload: Trick a victim into visiting a URL or page where the application passes attacker-controlled input (e.g., from URL parameters or request headers) into the ScrollRestoration props during SSR.
4. Trigger SSR rendering: The server renders the page with the unsanitized key value embedded in the HTML output, causing the injected script to execute in the victim's browser upon page load.
5. Achieve objective: The executed script can steal session cookies, exfiltrate sensitive data visible in the SSR-rendered page, or perform actions as the authenticated user (React Router Advisory, GitHub Advisory).

• Network: Unusual HTTP requests containing script tags or JavaScript payloads in URL parameters or headers directed at SSR-enabled React Router/Remix applications; unexpected outbound connections from the server to attacker-controlled domains following SSR rendering.
• Logs: Server-side rendering logs showing unexpected or malformed values in ScrollRestoration key parameters; access logs with encoded script payloads (%3Cscript%3E, </script>, etc.) in request parameters.
• File System: No specific file artifacts expected, as this is a reflected/SSR-injected XSS; however, any unexpected script files or web shells deposited post-exploitation should be investigated.
• Process: Unexpected child processes or network connections spawned by the Node.js SSR server process following rendering of crafted requests.

The primary remediation is to upgrade to React Router 7.12.0 or later (patched), or @remix-run/react 2.17.3 or later. As a workaround, developers can disable server-side rendering in Framework Mode, or migrate to Declarative Mode (<BrowserRouter>) or Data Mode (createBrowserRouter/<RouterProvider>), which are not affected by this vulnerability. IBM has issued multiple security bulletins for affected products and recommends applying the relevant iFixes or product updates (GitHub Advisory, React Router Advisory, IBM Security Bulletin).

The vulnerability was coordinated by arthurgervais and reported by zaddy6, with the advisory published by brophdawg11 (a React Router maintainer) on January 8, 2026. IBM issued multiple security bulletins across its product portfolio acknowledging the impact. The vulnerability received coverage in security news aggregators and was noted in Hacker News-style weekly recaps, though it did not generate significant community controversy given the absence of active exploitation (React Router Advisory, IBM Security Bulletin).