CVE-2026-42211: React Router's vendored turbo-stream v2 allows arbitrary constructor invocation via TYPE_ERROR deserialization leading to Unauth RCE

Synopsis

This is a deserialization vulnerability combined with prototype pollution in React Router's vendored turbo-stream v2 library, affecting React Router Framework Mode versions 7.0.0 through 7.14.1. An unauthenticated remote attacker can reach the affected application over the network, but must first ensure an existing prototype pollution vulnerability is present in the application code before exploiting a second-stage attack that invokes arbitrary constructors during deserialization. Successful exploitation gives the attacker full remote code execution on the server, enabling reads of sensitive data, modification of application state, and service disruption. HarborGuard tracks this advisory and will make a patched-image rebuild available the moment an upstream fix is published.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the React Router application over the network; the service must be exposed to external or internet-facing requests for this attack to be possible.

• AuthenticationNot required

  No credentials or session token are needed; the attack is launched from an unauthenticated external request.

• Victim interactionNot required

  No user action is required; the attacker triggers exploitation entirely through crafted inbound requests to the server.

• Attack complexityDetail

  Exploitation is complex because it requires a two-stage attack: an existing prototype pollution vulnerability must already be present in the application code before the deserialization step can be weaponized for RCE.

Blast Radius

• An attacker gains the ability to execute arbitrary code in the server process, reading any secrets, credentials, or application data accessible to that process.
• Application state and persisted data can be modified or destroyed, including database records and session stores reachable from the compromised process.
• The server process can be crashed or made unresponsive, disrupting availability for all users of the affected application.
• Because RCE grants process-level access, lateral movement to other services on the same host or internal network is possible if network segmentation is not enforced.