CVEDB API

Vulnerabilities

Vulnerable Software

Vulnerability Details CVE-2026-40181

React Router is a router for React. In versions 7.0.0 through 7.14.0 and 6.7.0 through 6.30.3, certain URLs passed to the redirect function can trigger an open redirect to an external domain due to path values starting with // being reinterpreted as protocol-relative URLs. The level of impact depends on the validation done by the application prior to returning the redirect. This does not impact applications using Declarative Mode (<BrowserRouter>). This is patched in versions 7.14.1 and 6.30.4.

Exploit prediction scoring system (EPSS) score

EPSS Score 0.0

EPSS Ranking 8.5%

CVSS Severity

CVSS v3 Score 6.1

References

https://github.com/remix-run/react-router/security/advisories/GHSA-2j2x-hqr9-3h42

Products affected by CVE-2026-40181

Shopify » React-Router » Version: 6.10.0

cpe:2.3:a:shopify:react-router:6.10.0
Shopify » React-Router » Version: 6.11.0

cpe:2.3:a:shopify:react-router:6.11.0
Shopify » React-Router » Version: 6.11.1

cpe:2.3:a:shopify:react-router:6.11.1
Shopify » React-Router » Version: 6.11.2

cpe:2.3:a:shopify:react-router:6.11.2
Shopify » React-Router » Version: 6.12.0

cpe:2.3:a:shopify:react-router:6.12.0
Shopify » React-Router » Version: 6.12.1

cpe:2.3:a:shopify:react-router:6.12.1
Shopify » React-Router » Version: 6.12.2

cpe:2.3:a:shopify:react-router:6.12.2
Shopify » React-Router » Version: 6.13.0

cpe:2.3:a:shopify:react-router:6.13.0
Shopify » React-Router » Version: 6.14.0

cpe:2.3:a:shopify:react-router:6.14.0
Shopify » React-Router » Version: 6.14.1

cpe:2.3:a:shopify:react-router:6.14.1
Shopify » React-Router » Version: 6.14.2

cpe:2.3:a:shopify:react-router:6.14.2
Shopify » React-Router » Version: 6.15.0

cpe:2.3:a:shopify:react-router:6.15.0
Shopify » React-Router » Version: 6.16.0

cpe:2.3:a:shopify:react-router:6.16.0
Shopify » React-Router » Version: 6.17.0

cpe:2.3:a:shopify:react-router:6.17.0
Shopify » React-Router » Version: 6.18.0

cpe:2.3:a:shopify:react-router:6.18.0
Shopify » React-Router » Version: 6.19.0

cpe:2.3:a:shopify:react-router:6.19.0
Shopify » React-Router » Version: 6.20.0

cpe:2.3:a:shopify:react-router:6.20.0
Shopify » React-Router » Version: 6.20.1

cpe:2.3:a:shopify:react-router:6.20.1
Shopify » React-Router » Version: 6.21.0

cpe:2.3:a:shopify:react-router:6.21.0
Shopify » React-Router » Version: 6.21.1

cpe:2.3:a:shopify:react-router:6.21.1
Shopify » React-Router » Version: 6.21.2

cpe:2.3:a:shopify:react-router:6.21.2
Shopify » React-Router » Version: 6.21.3

cpe:2.3:a:shopify:react-router:6.21.3
Shopify » React-Router » Version: 6.22.0

cpe:2.3:a:shopify:react-router:6.22.0
Shopify » React-Router » Version: 6.22.1

cpe:2.3:a:shopify:react-router:6.22.1
Shopify » React-Router » Version: 6.22.2

cpe:2.3:a:shopify:react-router:6.22.2
Shopify » React-Router » Version: 6.22.3

cpe:2.3:a:shopify:react-router:6.22.3
Shopify » React-Router » Version: 6.23.0

cpe:2.3:a:shopify:react-router:6.23.0
Shopify » React-Router » Version: 6.23.1

cpe:2.3:a:shopify:react-router:6.23.1
Shopify » React-Router » Version: 6.24.0

cpe:2.3:a:shopify:react-router:6.24.0
Shopify » React-Router » Version: 6.24.1

cpe:2.3:a:shopify:react-router:6.24.1
Shopify » React-Router » Version: 6.25.0

cpe:2.3:a:shopify:react-router:6.25.0
Shopify » React-Router » Version: 6.25.1

cpe:2.3:a:shopify:react-router:6.25.1
Shopify » React-Router » Version: 6.26.0

cpe:2.3:a:shopify:react-router:6.26.0
Shopify » React-Router » Version: 6.26.1

cpe:2.3:a:shopify:react-router:6.26.1
Shopify » React-Router » Version: 6.26.2

cpe:2.3:a:shopify:react-router:6.26.2
Shopify » React-Router » Version: 6.27.0

cpe:2.3:a:shopify:react-router:6.27.0
Shopify » React-Router » Version: 6.28.0

cpe:2.3:a:shopify:react-router:6.28.0
Shopify » React-Router » Version: 6.28.1

cpe:2.3:a:shopify:react-router:6.28.1
Shopify » React-Router » Version: 6.28.2

cpe:2.3:a:shopify:react-router:6.28.2
Shopify » React-Router » Version: 6.28.3

cpe:2.3:a:shopify:react-router:6.28.3
Shopify » React-Router » Version: 6.29.0

cpe:2.3:a:shopify:react-router:6.29.0
Shopify » React-Router » Version: 6.30.0

cpe:2.3:a:shopify:react-router:6.30.0
Shopify » React-Router » Version: 6.30.1

cpe:2.3:a:shopify:react-router:6.30.1
Shopify » React-Router » Version: 6.30.2

cpe:2.3:a:shopify:react-router:6.30.2
Shopify » React-Router » Version: 6.30.3

cpe:2.3:a:shopify:react-router:6.30.3
Shopify » React-Router » Version: 6.7.0

cpe:2.3:a:shopify:react-router:6.7.0
Shopify » React-Router » Version: 6.7.1

cpe:2.3:a:shopify:react-router:6.7.1
Shopify » React-Router » Version: 6.8.0

cpe:2.3:a:shopify:react-router:6.8.0
Shopify » React-Router » Version: 6.8.1

cpe:2.3:a:shopify:react-router:6.8.1
Shopify » React-Router » Version: 6.8.2

cpe:2.3:a:shopify:react-router:6.8.2
Shopify » React-Router » Version: 6.9.0

cpe:2.3:a:shopify:react-router:6.9.0
Shopify » React-Router » Version: 7.0.0

cpe:2.3:a:shopify:react-router:7.0.0
Shopify » React-Router » Version: 7.0.1

cpe:2.3:a:shopify:react-router:7.0.1
Shopify » React-Router » Version: 7.0.2

cpe:2.3:a:shopify:react-router:7.0.2
Shopify » React-Router » Version: 7.1.0

cpe:2.3:a:shopify:react-router:7.1.0
Shopify » React-Router » Version: 7.1.1

cpe:2.3:a:shopify:react-router:7.1.1
Shopify » React-Router » Version: 7.1.2

cpe:2.3:a:shopify:react-router:7.1.2
Shopify » React-Router » Version: 7.1.3

cpe:2.3:a:shopify:react-router:7.1.3
Shopify » React-Router » Version: 7.1.4

cpe:2.3:a:shopify:react-router:7.1.4
Shopify » React-Router » Version: 7.1.5

cpe:2.3:a:shopify:react-router:7.1.5
Shopify » React-Router » Version: 7.10.0

cpe:2.3:a:shopify:react-router:7.10.0
Shopify » React-Router » Version: 7.10.1

cpe:2.3:a:shopify:react-router:7.10.1
Shopify » React-Router » Version: 7.11.0

cpe:2.3:a:shopify:react-router:7.11.0
Shopify » React-Router » Version: 7.12.0

cpe:2.3:a:shopify:react-router:7.12.0
Shopify » React-Router » Version: 7.13.0

cpe:2.3:a:shopify:react-router:7.13.0
Shopify » React-Router » Version: 7.13.1

cpe:2.3:a:shopify:react-router:7.13.1
Shopify » React-Router » Version: 7.2.0

cpe:2.3:a:shopify:react-router:7.2.0
Shopify » React-Router » Version: 7.3.0

cpe:2.3:a:shopify:react-router:7.3.0
Shopify » React-Router » Version: 7.4.0

cpe:2.3:a:shopify:react-router:7.4.0
Shopify » React-Router » Version: 7.4.1

cpe:2.3:a:shopify:react-router:7.4.1
Shopify » React-Router » Version: 7.5.0

cpe:2.3:a:shopify:react-router:7.5.0
Shopify » React-Router » Version: 7.5.1

cpe:2.3:a:shopify:react-router:7.5.1
Shopify » React-Router » Version: 7.5.2

cpe:2.3:a:shopify:react-router:7.5.2
Shopify » React-Router » Version: 7.5.3

cpe:2.3:a:shopify:react-router:7.5.3
Shopify » React-Router » Version: 7.6.0

cpe:2.3:a:shopify:react-router:7.6.0
Shopify » React-Router » Version: 7.6.1

cpe:2.3:a:shopify:react-router:7.6.1
Shopify » React-Router » Version: 7.6.2

cpe:2.3:a:shopify:react-router:7.6.2
Shopify » React-Router » Version: 7.6.3

cpe:2.3:a:shopify:react-router:7.6.3
Shopify » React-Router » Version: 7.7.0

cpe:2.3:a:shopify:react-router:7.7.0
Shopify » React-Router » Version: 7.7.1

cpe:2.3:a:shopify:react-router:7.7.1
Shopify » React-Router » Version: 7.8.0

cpe:2.3:a:shopify:react-router:7.8.0
Shopify » React-Router » Version: 7.8.1

cpe:2.3:a:shopify:react-router:7.8.1
Shopify » React-Router » Version: 7.8.2

cpe:2.3:a:shopify:react-router:7.8.2
Shopify » React-Router » Version: 7.9.0

cpe:2.3:a:shopify:react-router:7.9.0
Shopify » React-Router » Version: 7.9.1

cpe:2.3:a:shopify:react-router:7.9.1
Shopify » React-Router » Version: 7.9.2

cpe:2.3:a:shopify:react-router:7.9.2
Shopify » React-Router » Version: 7.9.3

cpe:2.3:a:shopify:react-router:7.9.3
Shopify » React-Router » Version: 7.9.4

cpe:2.3:a:shopify:react-router:7.9.4
Shopify » React-Router » Version: 7.9.5

cpe:2.3:a:shopify:react-router:7.9.5
Shopify » React-Router » Version: 7.9.6

cpe:2.3:a:shopify:react-router:7.9.6

Vulnerabilities

Vulnerable Software

Vulnerability Details CVE-2026-40181

Products

Pricing

Contact Us