6.6

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-40181

CVE-2026-40181: React Router's same-origin redirect with path starting // causes open redirect via protocol-relative URL reinterpretation

React Router is a router for React. In versions 7.0.0 through 7.14.0 and 6.7.0 through 6.30.3, certain URLs passed to the redirect function can trigger an open redirect to an external domain due to path values starting with // being reinterpreted as protocol-relative URLs. The level of impact depends on the validation done by the application prior to returning the redirect. This does not impact applications using Declarative Mode (<BrowserRouter>). This is patched in versions 7.14.1 and 6.30.4.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-40181

CVE-2026-40181:

6.6

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
react-router	npm	>= 7.0.0, < 7.14.1	7.14.1
react-router	npm	>= 6.7.0, < 6.30.4	6.30.4

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is an open redirect caused by the improper handling of URLs starting with // in the redirect function. The browser interprets these as protocol-relative URLs, causing a redirect to an external domain. The provided patch addresses this by normalizing double slashes in redirect paths.

The analysis of the commits associated with the fix shows that the core change is in the normalizeRedirectLocation function in packages/react-router/lib/router/router.ts. The patch modifies this function to use a new removeDoubleSlashes utility. This utility replaces any occurrence of // with / in the path.

Before the patch, normalizeRedirectLocation would return a path starting with // without modification. This is the root cause of the vulnerability. By adding the call to removeDoubleSlashes, the malicious URL is sanitized, and the open redirect is prevented. Therefore, normalizeRedirectLocation is identified as the vulnerable function where the improperly handled input leads to the security flaw.

Vulnerable functions

normalizeRedirectLocation

packages/react-router/lib/router/router.ts

The `normalizeRedirectLocation` function processes redirect URLs. Prior to the patch, it did not handle URLs where the path starts with `//`. A path such as `//example.com` would be treated as a relative path by the router but interpreted as a protocol-relative URL by the browser, leading to an open redirect to `example.com`. The patch introduces `removeDoubleSlashes` to convert `//` to `/`, ensuring the redirect is treated as a same-origin path.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.