CVE-2026-21884 — React Router SSR XSS in ScrollRestoration

Description (CNA)

React Router is a router for React. In @remix-run/react version prior to 2.17.3. and react-router 7.0.0 through 7.11.0, a XSS vulnerability exists in in React Router's <ScrollRestoration> API in Framework Mode when using the getKey/storageKey props during Server-Side Rendering which could allow arbitrary JavaScript execution during SSR if untrusted content is used to generate the keys. There is no impact if server-side rendering in Framework Mode is disabled, or if Declarative Mode (<BrowserRouter>) or Data Mode (createBrowserRouter/<RouterProvider>) is being used. This issue has been patched in @remix-run/react version 2.17.3 and react-router version 7.12.0.

Affected (CNA)

Vendor / product	Versions
remix-run / react-router	affected @remix-run/react < 2.17.3; affected react-router >= 7.0.0, < 7.12.0

CWE

CWE-79

References

https://github.com/remix-run/react-router/security/advisories/GHSA-8v8x-cx79-35w7

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.

redhat-SADP

A cross site scripting flaw has been discovered in the npm react-router package. The cross site scripting (XSS) vulnerability exists in in React Router's <ScrollRestoration> API in Framework Mode when using the getKey/storageKey props during Server-Side Rendering which could allow arbitrary JavaScript execution during SSR if untrusted content is used to generate the keys.