CVE-2026-55685: 
Wolfi vulnerability analysis and mitigation

CVE-2026-55685 is an unauthenticated Denial of Service (DoS) vulnerability in the __manifest endpoint of React Router Framework Mode applications. Affecting versions 7.0.0 through 7.17.0, it allows unauthenticated attackers to send targeted requests that impose heavy computational load on the server, degrading response times or causing service unavailability. This issue is a follow-up to CVE-2026-42342 (GHSA-8x6r-g9mw-2r78) and covers additional exploitation scenarios not addressed by the prior fix. It carries a CVSS v3.1 base score of 7.5 (High) and a CVSS v4.0 base score of 8.7 (High) (GitHub Advisory, Feedly).

The root cause is uncontrolled resource consumption (CWE-400) combined with inefficient algorithmic complexity (CWE-407) and allocation of resources without limits or throttling (CWE-770) in the __manifest endpoint used by React Router's "Fog of War" route discovery feature in Framework Mode. Prior to the fix, the server-side route matching logic recompiled route path regular expressions on every manifest request rather than using precomputed matchers, and did not enforce a URL length limit — allowing crafted requests with deeply nested or excessively long path parameters to trigger worst-case regex evaluation and disproportionate CPU/memory consumption. The fix in PR #15186 precomputes route branch matchers, introduces a URL_LIMIT (7680 characters) enforced server-side with a 400 response for oversized requests, and adds ancestor path expansion logic (getPathsWithAncestors) to reduce redundant matching passes (GitHub Advisory, Fix Commit, Fix PR). This vulnerability does not affect applications using Declarative Mode (<BrowserRouter>) or Data Mode (createBrowserRouter/<RouterProvider>).

Successful exploitation causes availability degradation of the affected React Router Framework Mode server, manifesting as significantly increased response times or complete service unavailability for legitimate users. There is no confidentiality or integrity impact — the attack is purely a DoS. Because the endpoint is unauthenticated and the attack is automatable (confirmed by NVD SSVC), even a single attacker can sustain server overload without credentials, making it suitable for targeted disruption of web applications built on React Router Framework Mode (GitHub Advisory, Feedly).

No public proof-of-concept exploit code has been identified, and there is no confirmed evidence of in-the-wild exploitation as of the time of this report. The NVD SSVC assessment classifies exploitation as "none" observed, though the attack is marked "automatable" due to the lack of authentication or user interaction requirements. The EPSS score is approximately 0.577%, indicating a low but non-negligible probability of exploitation in the near term. The vulnerability is not currently listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Detection coverage is available via Qualys (detection ID 151108) and Tenable plugins (Feedly, GitHub Advisory).

1. Reconnaissance: Identify internet-facing web applications running React Router in Framework Mode (versions 7.0.0–7.17.0). This can be done by inspecting JavaScript bundles, HTTP headers, or response patterns characteristic of React Router SSR applications.
2. Locate the manifest endpoint: Confirm the /__manifest endpoint is accessible by sending a baseline GET request (e.g., GET /__manifest?paths=%2F&version=<version>). A valid JSON response confirms Framework Mode is active.
3. Craft a resource-exhausting request: Construct a request with an excessively long or deeply nested paths parameter that triggers worst-case route regex recompilation. For example, send a path string approaching or exceeding the server's processing threshold (e.g., a deeply nested path like /%61/%61/%61/... repeated many times).
4. Flood the endpoint: Send a high volume of such crafted requests concurrently to the /__manifest endpoint without any authentication. Each request forces the server to perform expensive route matching computations.
5. Observe impact: Monitor the target server for degraded response times or HTTP 503/timeout errors on legitimate requests, indicating successful resource exhaustion (GitHub Advisory, Fix Commit).

• Network: High volume of GET or POST requests to /__manifest (or custom manifest path) from one or more source IPs, particularly with unusually long paths query parameters; requests with paths values containing deeply nested URL segments (e.g., /%61/%61/%61/...).
• Logs: Web server or application access logs showing repeated requests to /__manifest?paths=... with large query strings; elevated HTTP 500 or timeout responses from the manifest endpoint; Node.js process logs showing high CPU utilization correlated with manifest endpoint requests.
• Process: Sustained high CPU usage by the Node.js server process without corresponding legitimate traffic spikes; increased event loop lag in Node.js APM metrics during periods of manifest endpoint traffic.

Upgrade to react-router version 7.18.0 or later, which introduces server-side URL length enforcement (rejecting requests exceeding 7,680 characters with HTTP 400), precomputed route matchers to eliminate redundant regex compilation, and improved ancestor path handling (GitHub Advisory, Fix PR, Changelog). As a temporary workaround prior to upgrading, operators can configure a reverse proxy (e.g., nginx, Cloudflare, AWS WAF) to rate-limit or block requests to the /__manifest endpoint from untrusted sources, or enforce maximum URL/query string length limits at the network edge. Applications using Declarative Mode or Data Mode are not affected and require no action.

Netlify published a changelog entry acknowledging the React Router security vulnerabilities shortly after disclosure, reflecting awareness among major hosting providers (Netlify Changelog). Red Hat tracked the issue via Bugzilla and their CVE advisory page, indicating relevance to enterprise Linux distributions that package React Router (Red Hat Advisory). Community discussion was noted on Bluesky and CVE tracking feeds, with general sentiment focused on the need to upgrade promptly given the unauthenticated nature of the attack surface.