CVE-2026-42342: React Router vulnerable to DoS via unbounded path expansion in __manifest endpoint

Synopsis

This is a denial-of-service vulnerability in React Router (Framework Mode) and Remix applications via the __manifest endpoint. A remote, unauthenticated attacker can send specially crafted requests that trigger unbounded path expansion, consuming disproportionate server resources. Successful exploitation degrades response times or makes the service completely unavailable to legitimate users. Fix versions (react-router 7.15.0 and @remix-run/server-runtime 2.17.5) have been published, and patched-image rebuilds are available on HarborGuard for affected environments.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must be able to reach the application over the network to send crafted HTTP requests to the __manifest endpoint.

• AuthenticationNot required

  No credentials or account are needed; the endpoint is reachable by any unauthenticated network client.

• Victim interactionNot required

  Exploitation is fully attacker-driven and requires no action from any user or operator of the application.

• Attack complexityDetail

  The exploit is reliable and condition-free; no race conditions, memory layout knowledge, or special environmental factors are required.

Blast Radius

• Crashes or severely degrades the targeted React Router or Remix application, making it unavailable to legitimate users.
• Server CPU and memory are consumed disproportionately by path expansion work, which can starve other co-hosted services or processes on the same host.
• Sustained attack traffic can exhaust infrastructure autoscaling budgets or trigger rate-limit penalties from cloud providers.