CVE-2026-21884 — React Router SSR XSS in ScrollRestoration

Affected: remix-run react-router, Red Hat Ansible Automation Platform 2.6 for RHEL 9, Red Hat Ansible Automation Platform 2.6, Red Hat OpenShift AI 2.25, Red Hat OpenShift AI 3.3, Red Hat Build of Kueue, Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 9

React Router is a router for React. In @remix-run/react version prior to 2.17.3. and react-router 7.0.0 through 7.11.0, a XSS vulnerability exists in in React Router's <ScrollRestoration> API in Framework Mode when using the getKey/storageKey props during Server-Side Rendering which could allow arbitrary JavaScript execution during SSR if untrusted content is used to generate the keys. There is no impact if server-side rendering in Framework Mode is disabled, or if Declarative Mode (<BrowserRouter>) or Data Mode (createBrowserRouter/<RouterProvider>) is being used. This issue has been patched in @remix-run/react version 2.17.3 and react-router version 7.12.0.

Most recent entries from all

CVE-2026-21884 — React Router SSR XSS in ScrollRestoration