CVE-2026-53668: 
JavaScript vulnerability analysis and mitigation

CVE-2026-53668 is an open redirect vulnerability in React Router that can lead to cross-site scripting (XSS). Applications using React Router with open redirects may allow attacker-crafted links to redirect users to unexpected external locations or serve as XSS vectors. The vulnerability affects react-router npm package versions >= 7.9.6 and <= 7.12.0 (patched in 7.13.0), and react-router-dom versions >= 6.30.2 and <= 6.30.4 (no patch available for the 6.x branch as of disclosure). It was published on July 22–23, 2026, and carries a CVSS v3.1 base score of 6.9 (Medium) (GitHub Advisory).

The root cause is improper handling of the resolvePath function in React Router's router utilities (CWE-601: URL Redirection to Untrusted Site). Prior to the fix, the resolvePath function contained an isAbsoluteUrl check that, when triggered, would pass the pathname through unmodified — allowing protocol-relative paths such as //attacker.com to be treated as valid navigation targets rather than being normalized to relative paths. The fix (commit 3a5b5ad) removes the absolute URL check entirely and always applies double-slash normalization, ensuring paths like //google.com are collapsed to /google.com. An attacker can craft a malicious link that, when clicked by a victim, causes the React Router application to navigate to an attacker-controlled external site or execute injected scripts in the browser context (GitHub Advisory, Fix Commit).

Successful exploitation allows an unauthenticated attacker to redirect users from a trusted application to an attacker-controlled external site, enabling phishing, credential harvesting, or malware delivery. Additionally, the vulnerability can serve as an XSS vector, allowing malicious scripts to execute within the user's browser in the context of the vulnerable application, potentially exposing session tokens, cookies, or other sensitive data. Availability is not impacted, but confidentiality is rated High and integrity Low per the CVSS scoring (GitHub Advisory).

1. Identify a vulnerable application: Locate a web application using react-router versions 7.9.6–7.12.0 or react-router-dom 6.30.2–6.30.4 that exposes navigation links influenced by user-controlled input.
2. Craft a malicious URL: Construct a link that passes a protocol-relative path (e.g., //attacker.com) or a double-slash path as a navigation target to the React Router useNavigate hook or <Link> component.
3. Deliver the link: Send the crafted URL to a victim via phishing email, social engineering, or by embedding it in a page the victim is likely to visit.
4. Trigger the redirect: When the victim clicks the link, React Router's unpatched resolvePath function treats //attacker.com as an absolute URL and navigates the browser to the attacker-controlled site, bypassing same-origin expectations.
5. Achieve objective: The victim is redirected to a phishing page, or if an XSS payload is embedded, malicious scripts execute in the browser within the context of the legitimate application, enabling session theft or further attacks (GitHub Advisory, Fix Commit).

• Network: Outbound browser navigations from a React Router application to unexpected external domains, particularly those initiated via protocol-relative URLs (e.g., //attacker.com).
• Logs: Server or CDN access logs showing referrer headers from the legitimate application domain pointing to external, unrelated destinations; unusual redirect chains in web proxy logs.
• Application Behavior: Users reporting unexpected redirects to external sites after clicking internal application links; browser console errors related to cross-origin navigation or Content Security Policy violations.

Upgrade react-router to version 7.13.0 or later, which includes the fix that removes the flawed isAbsoluteUrl check in resolvePath and enforces double-slash normalization for all paths (GitHub Advisory, React Router v7.13.0 Release). For react-router-dom 6.x users (versions 6.30.2–6.30.4), no patched version is listed in the advisory; consider migrating to the v7 branch or implementing application-level allowlists for redirect destinations. As a defense-in-depth measure, implement a Content-Security-Policy header to restrict navigation and script execution to trusted origins.

Netlify published a changelog entry on July 23, 2026 referencing React Router security vulnerabilities, indicating awareness among hosting providers of the React ecosystem (Netlify Changelog). The fix was merged by React Router maintainer brophdawg11 and shipped in version 7.13.0, with community members noting in the associated pull request that the underlying change (removing absolute URL handling from resolvePath) was a breaking behavioral change that had not been clearly documented in prior releases (Fix PR).