React Router CVE-2026-42342: Quick Look at the __manifest Endpoint Denial of Service Vulnerability

Introduction

A crafted HTTP request to a single internal endpoint can pin a React Router server's CPU and leave the entire application unresponsive for legitimate users. CVE-2026-42342, disclosed on June 2, 2026, is a denial-of-service condition in the __manifest endpoint that React Router Framework Mode and Remix v2 applications use. It carries a CVSS 7.5 (High) rating, and exploitation requires no authentication.

React Router is downloaded over 13.2 million times per week on npm, so the potential blast radius is significant. The actual exposure is limited to applications running Framework Mode or Remix with server-side rendering. Configurations that use client-side routing only are unaffected.

Technical Information

The __manifest Endpoint

The __manifest endpoint is an internal route that React Router exposes in Framework Mode. It serves the manifest data the client needs for route discovery and asset loading. When a client navigates to a route, React Router computes a manifest URL by taking the normalized basename and appending /__manifest. The endpoint is a core part of the Framework Mode routing architecture and does not exist in Declarative Mode (<BrowserRouter>) or Data Mode (createBrowserRouter/<RouterProvider>).

Root Cause: Unbounded Path Expansion

The vulnerability falls under CWE-400 (Uncontrolled Resource Consumption). The __manifest endpoint's path-processing logic puts no limit on path expansion during route matching or manifest generation. A specially crafted request to the endpoint sends the server into an unbounded path expansion that consumes CPU and/or memory out of all proportion to the size of the request.

The bug is algorithmic resource exhaustion rather than memory corruption, which makes it deterministic and reliable. An attacker does not need to win a race condition or guess memory layouts, because the crafted input produces resource exhaustion every time.

CVSS Breakdown

The CVSS v3.1 vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, which breaks down as follows:

The impact profile (C:N/I:N/A:H) confirms this is a pure availability attack. The vulnerability degrades or eliminates service availability, and it does not leak or corrupt any data.

Attack Flow

Based on the advisory and the CVSS characteristics, exploitation is straightforward:

1. Reconnaissance: The attacker identifies a target application running React Router Framework Mode or Remix v2. A simple HTTP request can confirm that the /__manifest endpoint is present.

2. Crafted Request: The attacker sends one or more specially crafted HTTP requests to the /__manifest endpoint. The requests contain path structures designed to trigger unbounded expansion in the server-side logic for route matching or manifest generation.

3. Resource Exhaustion: The server processes the crafted path(s) with no limit on expansion and consumes disproportionate CPU and/or memory.

4. Service Degradation: As the malicious request(s) eat server resources, legitimate requests slow down. With enough attack volume (or a single request that is expensive enough), the server becomes completely unavailable.

The attack needs no authentication or user interaction and can be launched from any network location. Because it is an HTTP-based DoS, it is easy to automate with standard tooling.

Scope Limitation

Only Framework Mode applications are vulnerable. The __manifest endpoint is a Framework Mode feature and does not exist in the other two React Router modes:

• Declarative Mode (<BrowserRouter>): Not affected
• Data Mode (createBrowserRouter/<RouterProvider>): Not affected
• Framework Mode: Affected

The majority of React Router installations use client-side routing only, so they have zero exposure to this CVE.

Affected Systems and Versions

Two packages are affected:

For react-router, the affected range spans the entire React Router 7.x Framework Mode lineage, from its introduction onward. For @remix-run/server-runtime, it covers versions 2.10.0 through 2.17.4.

Only applications using React Router Framework Mode or Remix v2 with server-side rendering are vulnerable. Applications using Declarative Mode (<BrowserRouter>) or Data Mode (createBrowserRouter/<RouterProvider>) are explicitly not affected.

Vendor Security History

The React Router project, maintained by Remix Run (acquired by Shopify in late 2022), has seen a notable rise in security disclosures. A January 2026 Netlify article documented six separate CVEs affecting React Router and Remix in a single batch, across several vulnerability classes. Among them:

Snyk's vulnerability database lists multiple entries for react-router v7.x and @remix-run/server-runtime, covering XSS, CSRF, and now this DoS vulnerability. The project has a formal security policy and uses GitHub Security Advisories for coordinated disclosure.

The fixes for CVE-2026-42342 (react-router 7.15.0 and @remix-run/server-runtime 2.17.5) shipped on the disclosure date, which is a good sign. Still, the recurring vulnerabilities across the Framework Mode architecture suggest that the server-side rendering components could benefit from a more systematic security review instead of continued reactive patching.

References

• NVD: CVE-2026-42342
• GitHub Security Advisory GHSA-8x6r-g9mw-2r78: DoS via unbounded path expansion in __manifest endpoint
• React Router Security Policy
• React Router Security Advisories
• React Router Official Disclosure on X (Twitter)
• Netlify: 6 new React Router and Remix CVEs
• Snyk: react-router package vulnerabilities
• Snyk: @remix-run/server-runtime vulnerabilities
• zhero_web_security: React Router and the Remix'ed path
• React Router Discussion: Manifest Fallback Behavior
• CISA Known Exploited Vulnerabilities Catalog