Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
Miggo AIRoot Cause AnalysisThe vulnerability is an open redirect in React Router, which is a bypass of a previous fix (CVE-2025-68470). The root cause is the incomplete handling of backslashes in URLs, which allows attackers to craft URLs that are misinterpreted as external links. The patch addresses this by consolidating URL normalization logic and ensuring that both forward and backslashes are handled correctly.
The analysis of the patch commit 8395184574726b81be096ae0f906b6c7469a042c reveals several key changes:
A new file packages/react-router/lib/router/url.ts is introduced to centralize URL-related regular expressions and utility functions. The new ABSOLUTE_URL_REGEX now correctly identifies protocol-relative URLs starting with either // or \\.
The removeDoubleSlashes function in packages/react-router/lib/router/utils.ts is updated to replace repeated backslashes and forward slashes, preventing them from being used to bypass security checks.
The normalizeRedirectLocation function in packages/react-router/lib/router/router.ts is updated to use the new regular expressions and normalization functions, ensuring that redirect URLs are correctly processed.
In packages/react-router/lib/rsc/browser.tsx, the createCallServer function, which handles server-side redirects in React Server Components, is modified to use a new normalizeRedirectLocation function. This ensures that redirect URLs from the server are properly sanitized before being used for navigation.
These changes indicate that the vulnerability existed in the URL parsing and redirect handling logic of React Router. The identified vulnerable functions are those that were directly involved in processing user-supplied URLs without adequate sanitization of backslashes.
removeDoubleSlashespackages/react-router/lib/router/utils.ts
resolveTopackages/react-router/lib/router/utils.ts
createCallServerpackages/react-router/lib/rsc/browser.tsx
normalizeRedirectLocationpackages/react-router/lib/router/router.ts
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| react-router | npm | >= 6.0.0, < 7.18.0 | 7.18.0 |