7.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-34077

CVE-2026-34077: React Router vulnerable to Denial of Service via reflected user input in single-fetch

React Router is a router for React. In versions 7.7.0 through 7.13.1, when using React Router's unstable React Server Components (RSC) APIs, there is a potential client-side Cross-Site Scripting (XSS) vulnerability in the RSC redirect handling if redirects come from untrusted sources. This does not impact applications that are not using the unstable RSC APIs in React Router. This is patched in version 7.13.2.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-34077

CVE-2026-34077:

7.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

SSVC / BOD 26-04 ↗

Exploitation NoneAutomatable YesTech Impact Partial

Select your environment

→SSVCDeferfix on upgrade

Runtime reachability resolves your actual outcome.Book a demo

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
react-router	npm	>= 7.0.0, < 7.14.0	7.14.0
turbo-stream	npm	< 3.0.0	3.0.0

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability lies in the custom serialization and deserialization logic for JavaScript Error objects within a vendored version of the turbo-stream library. The analysis of the patch commit 59811921d3c7d599077b8cadccdcd65a233165e0 reveals the exact weakness.

The stringify function in flatten.ts would serialize an Error object, including its specific name (e.g., 'EvalError'). The hydrate function in unflatten.ts would then deserialize this payload. The critical flaw was in hydrate, where it would use the provided errorType from the serialized data to dynamically look up a constructor on the global object (globalObj[errorType]) and instantiate it.

An attacker could exploit this by sending a crafted payload with a malicious errorType string. When the server deserializes this payload using hydrate, it would attempt to execute new global[attacker_controlled_string](). This could be used to trigger a constructor that consumes excessive resources or causes the application to crash, resulting in a Denial of Service. The patch mitigates this by removing the custom error type handling entirely, always deserializing errors as generic new Error(message), thus preventing the dynamic constructor lookup.

Vulnerable functions

stringify

packages/react-router/vendor/turbo-stream-v2/flatten.ts

The `stringify` function was responsible for serializing data. It included special logic to serialize the `name` of an Error object if it wasn't a generic 'Error'. This allowed a crafted error object's name to be included in the serialized payload, which was then used insecurely during deserialization.

hydrate

packages/react-router/vendor/turbo-stream-v2/unflatten.ts

The `hydrate` function, used for deserialization, would take a serialized `errorType` from the payload and use it to dynamically look up a constructor on the global object (e.g., `window` or `global`). An attacker could provide a malicious `errorType` string, causing the server to instantiate an unexpected object (e.g., one with a computationally expensive constructor), leading to a Denial of Service.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.