CVE-2026-55685

highcovered by 2 sourcesfirst seen 2026-07-24

This is a follow up to https://github.com/remix-run/react-router/security/advisories/GHSA-8x6r-g9mw-2r78 that covers additional reported scenarios in which the manifest endpoint could be accessed via unauthenticated targeted requests that would put heavy load on the server and slow down response times. [!NOTE] This only impacts Framework Mode applications. This does not impact your application if you are using Declarative or Data Mode.

⚡ Watch CVE-2026-55685

Get an email if CVE-2026-55685 is added to CISA KEV, gains public exploit code, or a new advisory cites it — max one per day, one-click unsubscribe.

Exploitation outlook

Low exploitation risk0.58% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 44% of all EPSS-scored CVEs.

Advisory coverage (2)

unknownCVE-2026-55685: React Router is a router for React. In versions 7.0.0 through 7.17.0, the manifest endpoint co…nvd · 2026-07-27
highGHSA-chx6-hx7r-mcp5: React Router: Unauthenticated Denial of Service via Inefficient Route Matchingghsa · 2026-07-24

External references

NVD record for CVE-2026-55685

CVE.org record

Embed the live status

— this badge updates automatically when the KEV or exploit status changes. How to embed it →

[![CVE-2026-55685 status](https://www.csirts.com/badge/CVE-2026-55685)](https://www.csirts.com/cve/CVE-2026-55685)