chore(react-router): Update dependency react-router to v7.18.2 [SECURITY] by renovate[bot] · Pull Request #9567 · clerk/javascript

renovate · 2026-08-26T10:06:36Z

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
react-router (source)	`7.15.0` → `7.18.2`

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

React Router: Potential CSRF via PUT/PATCH/DELETE document requests

CVE-2026-53663 / GHSA-84g9-w2xq-vcv6

More information

Details

Certain CSRF checks in React Router v7 Framework Mode were insufficient and run on POST requests, but were bypassed on PUT/PATCH/DELETE requests. This is a low severity vulnerability because modern browser protections (CORS preflight, SameSite cookies) already block the cross-origin attack vectors that this missing CSRF check would otherwise gate.

[!NOTE]
This does not impact your React Router application if you are using Declarative Mode (<BrowserRouter>) or Data Mode (createBrowserRouter/<RouterProvider>).

Severity

CVSS Score: 3.1 / 10 (Low)
Vector String: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

React Router: Arbitrary Constructor Injection via deserializeErrors() in React Router SSR Hydration

CVE-2026-53666 / GHSA-337j-9hxr-rhxg

More information

Details

If application code allows attacker supplied input to overwrite certain aspects of errors caught by the SSR process, then it was possible for attacker to trigger unexpected constructor execution on the client which would trigger outbound network traffic. This is only possible with very specific (and unlikely) application layer code.

[!NOTE]
This does not impact your application if you are using Declarative Mode. This only impacts Framework Mode and Data Mode applications doing manual SSR/hydration

Severity

CVSS Score: 6.1 / 10 (Medium)
Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

React Router: RSCErrorHandler Missing Protocol Validation (XSS)

CVE-2026-53667 / GHSA-h8fp-f39c-q6mh

More information

Details

This is a follow up to GHSA-8646-j5j9-6r62. React Router was alerted of a code path in the (unstable) RSC error handling path in which redirects from untrusted sources could still result in an XSS vector via attacker-supplied redirect targets

[!NOTE]
This only affects your application if you are using the unstable RSC APIs

Severity

CVSS Score: 6.9 / 10 (Medium)
Vector String: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:L/A:N

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

React Router: Open redirect via backslash in and useNavigate (CVE-2025-68470 bypass)

CVE-2026-53669 / GHSA-wrjc-x8rr-h8h6

More information

Details

This is a follow up to CVE-2025-68470. React Router was alerted to certain scenarios in which the fix there was incomplete so there still existed some scenarios where attacker supplied paths passed to navigation mechanisms could result in unexpected external navigations.

Severity

CVSS Score: 5.1 / 10 (Medium)
Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:L/SI:L/SA:N

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

React Router: Unauthenticated Denial of Service via Inefficient Route Matching

CVE-2026-55685 / GHSA-chx6-hx7r-mcp5

More information

Details

This is a follow up to GHSA-8x6r-g9mw-2r78 that covers additional reported scenarios in which the manifest endpoint could be accessed via unauthenticated targeted requests that would put heavy load on the server and slow down response times.

[!NOTE]
This only impacts Framework Mode applications. This does not impact your application if you are using Declarative or Data Mode.

Severity

CVSS Score: 8.7 / 10 (High)
Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

React Router: RSC Mode CSRF Bypass Allows Action Execution Before 400 Response

GHSA-qwww-vcr4-c8h2

More information

Details

This is a follow up to CVE-2026-22030 to address related CSRF flows in unstable RSC code paths.

[!NOTE]
This only affects your application if you are using the unstable RSC APIs

Severity

CVSS Score: 7.1 / 10 (High)
Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Release Notes

remix-run/react-router (react-router)

Patch Changes

Fix server handler prerender responses when using ssr: false and future.v8_trailingSlashAwareDataRequests: true. Avoids false positive "SPA Mode" detection when serving prerendered paths (#15173)
Use the ServerRouter nonce for nonce-aware SSR components when they don't provide their own value so strict CSP pages can load them. (#15170)
Use turbo-stream to serialize and deserialize Framework Mode hydration errors (#15175)
Precompute route branch matchers to avoid recompiling route path regexes during matching (#15186)
Use the constructed request URL host when validating action request origins. (#15185)
Remove the un-documented custom error serialization logic from Data Mode SSR built-in hydration flows (#15175)
Validate protocols in RSC render redirects (#15177)
Consolidate url normalization logic and better handle mixed slashes (#15176)

`v7.17.0`

Compare Source

Minor Changes

Ship a subset of the official documentation inside the react-router package (#15121)
- Markdown docs are now available in node_modules/react-router/docs, letting AI coding agents and the React Router agent skills read official docs locally
- Excludes auto-generated API docs (api/), community/ content, and tutorials (tutorials/)

`v7.16.0`

Compare Source

Minor Changes

Stabilize future.unstable_trailingSlashAwareDataRequests as future.v8_trailingSlashAwareDataRequests (#15098)

Patch Changes

Disable manifest path when lazy route dicovery is disabled (#15068)
Fix browser URL creation to use the configured history window instead of the global window. (#15066)
- Pass the history/router window through to createBrowserURLImpl so custom window contexts keep the correct URL origin.
Fix useNavigation() return type to preserve discriminated union across navigation states (#15095)
Widen MetaDescriptor script:ld+json type from LdJsonObject to LdJsonObject | LdJsonObject[] to permit multiple JSON-LD schemas in a single <script type="application/ld+json"> tag emitted by <Meta /> (#15082)

`v7.15.1`

Compare Source

Patch Changes

Update router to operate on fetcher Maps in an immutable manner to avoid delayed React renders from potentially reading an updated but not yet committed Map. This could result in brief flickers in some fetcher-driven optimistic UI scenarios. (#15028)
Fix serverLoader() returning stale SSR data when a client navigation aborts pending hydration before the hydration clientLoader resolves (#15022)
Fix RouterProvider onError callback not being called for synchronous initial loader errors in SPA mode (#15039) (#14942)
Memoize useFetchers to return a stable identity and only change if fetchers changed (#15028)
Internal refactor to consolidate mutation request detection through shared utility (#15033)

Unstable Changes

⚠️ Unstable features are not recommended for production use

Add a new unstable_useRouterState() hook that consolidates access to active and pending router states (RFC: #12358) (#15017)

Data/Framework/RSC only — throws when used without a data router

This should allow you to consolidate usages of the following hooks which will likely be deprecated and removed in a future major version

useLocation
useSearchParams
useParams
useMatches
useNavigationType
useNavigation

let { active, pending } = unstable_useRouterState();

// Active is always populated with the current location
active.location; // replaces `useLocation()`
active.searchParams; // replaces `useSearchParams()[0]`
active.params; // replaces `useParams()`
active.matches; // replaces `useMatches()`
active.type; // replaces `useNavigationType()`

// Pending is only populated during a navigation
pending.location; // replaces `useNavigation().location`
pending.searchParams; // equivalent to `new URLSearchParams(useNavigation().search)`
pending.params; // Not directly accessible today
pending.matches; // Not directly accessible today
pending.type; // Not directly accessible today
pending.state; // replaces `useNavigation().state`
pending.formMethod; // replaces useNavigation().formMethod
pending.formAction; // replaces useNavigation().formAction
pending.formEncType; // replaces useNavigation().formEncType
pending.formData; // replaces useNavigation().formData
pending.json; // replaces useNavigation().json
pending.text; // replaces useNavigation().text

Configuration

📅 Schedule: (in timezone GMT)

Branch creation
- At any time (no schedule defined)
Automerge
- At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

vercel · 2026-08-26T10:06:39Z

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
clerk-js-sandbox	Ready	Preview	Aug 27, 2026 7:56pm
swingset	Ready	Preview	Aug 27, 2026 7:56pm

changeset-bot · 2026-08-26T10:06:41Z

⚠️ No Changeset found

Latest commit: 9d8be6b

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

pkg-pr-new · 2026-08-26T10:09:32Z

Open in StackBlitz

@clerk/astro

npm i https://pkg.pr.new/@clerk/astro@9567

@clerk/backend

npm i https://pkg.pr.new/@clerk/backend@9567

@clerk/chrome-extension

npm i https://pkg.pr.new/@clerk/chrome-extension@9567

@clerk/clerk-js

npm i https://pkg.pr.new/@clerk/clerk-js@9567

@clerk/electron

npm i https://pkg.pr.new/@clerk/electron@9567

@clerk/electron-passkeys

npm i https://pkg.pr.new/@clerk/electron-passkeys@9567

@clerk/eslint-plugin

npm i https://pkg.pr.new/@clerk/eslint-plugin@9567

@clerk/expo

npm i https://pkg.pr.new/@clerk/expo@9567

@clerk/expo-google-signin

npm i https://pkg.pr.new/@clerk/expo-google-signin@9567

@clerk/expo-passkeys

npm i https://pkg.pr.new/@clerk/expo-passkeys@9567

@clerk/express

npm i https://pkg.pr.new/@clerk/express@9567

@clerk/fastify

npm i https://pkg.pr.new/@clerk/fastify@9567

@clerk/hono

npm i https://pkg.pr.new/@clerk/hono@9567

@clerk/localizations

npm i https://pkg.pr.new/@clerk/localizations@9567

@clerk/nextjs

npm i https://pkg.pr.new/@clerk/nextjs@9567

@clerk/nuxt

npm i https://pkg.pr.new/@clerk/nuxt@9567

@clerk/react

npm i https://pkg.pr.new/@clerk/react@9567

@clerk/react-router

npm i https://pkg.pr.new/@clerk/react-router@9567

@clerk/shared

npm i https://pkg.pr.new/@clerk/shared@9567

@clerk/tanstack-react-start

npm i https://pkg.pr.new/@clerk/tanstack-react-start@9567

@clerk/testing

npm i https://pkg.pr.new/@clerk/testing@9567

@clerk/ui

npm i https://pkg.pr.new/@clerk/ui@9567

@clerk/upgrade

npm i https://pkg.pr.new/@clerk/upgrade@9567

@clerk/vue

npm i https://pkg.pr.new/@clerk/vue@9567

commit: 9d8be6b

github-actions · 2026-08-26T10:10:22Z

API Changes Report

Generated by Break Check on 2026-08-27T20:01:27.025Z

Summary

Metric	Count
Packages analyzed	19
Packages with changes	0
🔴 Breaking changes	0
🟡 Non-breaking changes	0
🟢 Additions	0

No API Changes Detected

All packages have stable APIs with no detected changes.

Report generated by Break Check

_{Last ran on 9d8be6b.}

…ITY]

renovate Bot added the dependencies Pull requests that update a dependency file label Aug 26, 2026

renovate Bot enabled auto-merge (squash) August 26, 2026 10:06

github-actions Bot added the react-router label Aug 26, 2026

vercel Bot deployed to Preview – clerk-js-sandbox August 26, 2026 10:07 View deployment

vercel Bot deployed to Preview – swingset August 26, 2026 10:08 View deployment

renovate Bot force-pushed the renovate/npm-react-router-vulnerability branch from 853882a to 284a7ee Compare August 26, 2026 21:06

vercel Bot deployed to Preview – clerk-js-sandbox August 26, 2026 21:07 View deployment

vercel Bot deployed to Preview – swingset August 26, 2026 21:09 View deployment

renovate Bot force-pushed the renovate/npm-react-router-vulnerability branch from 284a7ee to 7d92d55 Compare August 27, 2026 07:56

vercel Bot deployed to Preview – clerk-js-sandbox August 27, 2026 07:57 View deployment

vercel Bot deployed to Preview – swingset August 27, 2026 07:58 View deployment

renovate Bot force-pushed the renovate/npm-react-router-vulnerability branch from 7d92d55 to b26ceab Compare August 27, 2026 11:49

vercel Bot deployed to Preview – clerk-js-sandbox August 27, 2026 11:50 View deployment

vercel Bot deployed to Preview – swingset August 27, 2026 11:52 View deployment

renovate Bot force-pushed the renovate/npm-react-router-vulnerability branch from b26ceab to ff467d3 Compare August 27, 2026 14:57

vercel Bot deployed to Preview – clerk-js-sandbox August 27, 2026 14:58 View deployment

vercel Bot deployed to Preview – swingset August 27, 2026 15:00 View deployment

renovate Bot force-pushed the renovate/npm-react-router-vulnerability branch from ff467d3 to 430b559 Compare August 27, 2026 15:02

vercel Bot deployed to Preview – clerk-js-sandbox August 27, 2026 15:03 View deployment

vercel Bot deployed to Preview – swingset August 27, 2026 15:05 View deployment

renovate Bot force-pushed the renovate/npm-react-router-vulnerability branch from 430b559 to e1b846f Compare August 27, 2026 18:09

vercel Bot deployed to Preview – clerk-js-sandbox August 27, 2026 18:09 View deployment

vercel Bot deployed to Preview – swingset August 27, 2026 18:12 View deployment

renovate Bot force-pushed the renovate/npm-react-router-vulnerability branch from e1b846f to ef72d2c Compare August 27, 2026 18:56

vercel Bot deployed to Preview – clerk-js-sandbox August 27, 2026 18:56 View deployment

vercel Bot deployed to Preview – swingset August 27, 2026 18:58 View deployment

renovate Bot force-pushed the renovate/npm-react-router-vulnerability branch from ef72d2c to f2c72d2 Compare August 27, 2026 19:07

vercel Bot deployed to Preview – clerk-js-sandbox August 27, 2026 19:07 View deployment

vercel Bot deployed to Preview – swingset August 27, 2026 19:09 View deployment

chore(react-router): Update dependency react-router to v7.18.2 [SECUR…

9d8be6b

…ITY]

renovate Bot force-pushed the renovate/npm-react-router-vulnerability branch from f2c72d2 to 9d8be6b Compare August 27, 2026 19:54

vercel Bot deployed to Preview – clerk-js-sandbox August 27, 2026 19:54 View deployment

vercel Bot deployed to Preview – swingset August 27, 2026 19:56 View deployment

Navigation Menu

Uh oh!

chore(react-router): Update dependency react-router to v7.18.2 [SECURITY] - #9567

chore(react-router): Update dependency react-router to v7.18.2 [SECURITY]#9567
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/npm-react-router-vulnerability

renovate Bot commented Aug 26, 2026

Uh oh!

vercel Bot commented Aug 26, 2026 •

edited

Loading

Uh oh!

changeset-bot Bot commented Aug 26, 2026 •

edited

Loading

Uh oh!

pkg-pr-new Bot commented Aug 26, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented Aug 26, 2026 •

edited

Loading

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Uh oh!

Conversation

renovate Bot commented Aug 26, 2026

React Router: Potential CSRF via PUT/PATCH/DELETE document requests

Details

Severity

References

React Router: Arbitrary Constructor Injection via deserializeErrors() in React Router SSR Hydration

Details

Severity

References

React Router: RSCErrorHandler Missing Protocol Validation (XSS)

Details

Severity

References

React Router: Open redirect via backslash in and useNavigate (CVE-2025-68470 bypass)

Details

Severity

References

React Router: Unauthenticated Denial of Service via Inefficient Route Matching

Details

Severity

References

React Router: RSC Mode CSRF Bypass Allows Action Execution Before 400 Response

Details

Severity

References

Release Notes

v7.18.2: v7.18.2

v7.18.1: v7.18.1

v7.18.0

Patch Changes

v7.17.0

Minor Changes

v7.16.0

Minor Changes

Patch Changes

v7.15.1

Patch Changes

Unstable Changes

Configuration

Uh oh!

vercel Bot commented Aug 26, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

changeset-bot Bot commented Aug 26, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

⚠️ No Changeset found

Uh oh!

pkg-pr-new Bot commented Aug 26, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Aug 26, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

API Changes Report

Summary

No API Changes Detected

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

`v7.18.2`: v7.18.2

`v7.18.1`: v7.18.1

`v7.18.0`

`v7.17.0`

`v7.16.0`

`v7.15.1`

vercel Bot commented Aug 26, 2026 •

edited

Loading

changeset-bot Bot commented Aug 26, 2026 •

edited

Loading

pkg-pr-new Bot commented Aug 26, 2026 •

edited

Loading

github-actions Bot commented Aug 26, 2026 •

edited

Loading