CVE-2026-34077: React Router vulnerable to Denial of Service via reflected user input in single-fetch

Synopsis

A denial-of-service vulnerability affects React Router versions 7.7.0 through 7.13.1 when the unstable React Server Components (RSC) APIs are in use. The flaw is reachable over the network without any authentication or user interaction, allowing an unauthenticated remote attacker to trigger it from the internet. Successful exploitation disrupts service availability for the affected application. HarborGuard tracks this advisory and will make a patched-image rebuild available as soon as an upstream fix is published.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable component is exposed over the network, so the attacker must be able to reach the service via a standard internet or intranet HTTP connection.

• AuthenticationNot required

  No account or credential of any privilege level is needed to send a malicious request to the affected endpoint.

• Victim interactionNot required

  The exploit executes without any action from a user or administrator on the target system.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is straightforward and does not depend on race conditions, specific memory layout, or other environmental factors.

Blast Radius

• A successful attacker crashes or hangs the React Router application process, making it unavailable to legitimate users.
• No confidential data is read by the attacker; the impact is limited to service disruption.
• No persistent data is modified; integrity of stored records is unaffected.
• Availability of the affected service is fully compromised for the duration of the attack.