npm package report

Is react-router safe?

20 known vulnerabilities, worst severity HIGH.

// reach

44 direct dependencies

11 carry known advisories, worst CRITICAL

46 packages depend on it

an advisory here reaches each of them

Create a free accountfor every dependency path, dependent and what to upgrade

// ai model usage

Tracked for PyPI packages. HuggingFace models declare Python dependencies, so npm packages are not covered.

cvss

8.7

high

CVSS v4.0 base score out of 10

epss

0.71%

medium

chance of exploitation in 30 days, 54th percentile of all CVEs

xyz score

4.7

medium

CyberXYZ composite out of 10

fig. 01 — GHSA-chx6-hx7r-mcp5, the advisory selected below

// 20 advisories

GHSA-chx6-hx7r-mcp5

HIGHOSV ratingCVE-2026-55685

This is a follow up to https://github.com/remix-run/react-router/security/advisories/GHSA-8x6r-g9mw-2r78 that covers additional reported scenarios in which the manifest endpoint could be accessed via unauthenticated targeted requests that would put heavy load on the server and slow down response times.

> [!NOTE] > This only impacts Framework Mode applications. This does not impact your application if you are using Declarative or Data Mode.

// cvss v4.0 vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Attack vector: Network
Attack complexity: Low
Attack requirements: None
Privileges required: None
User interaction: None
Confidentiality (vulnerable system): None
Integrity (vulnerable system): None
Availability (vulnerable system): High
Confidentiality (subsequent systems): None
Integrity (subsequent systems): None
Availability (subsequent systems): None

Checked 2026-11-06 at 23:02 UTC. The most recent advisory here was published 2026-07-24. Updated continuously from NVD, GHSA, OSV and CNA feeds.