{ "@id": "urn:uuid:9cf8ac26-9f72-4121-b7aa-441042ef1a8a", "role": "Document Creator", "author": "https://tuxcare.com", "version": 8, "@context": "https://openvex.dev/ns/v0.2.0", "timestamp": "2026-11-04T00:34:56.138110+00:00", "statements": [ { "status": "affected", "products": [ { "@id": "pkg:npm/react-router@7.18.1-tuxcare.1", "identifiers": { "purl": "pkg:npm/react-router@7.18.1-tuxcare.1" } } ], "timestamp": "2026-10-30T14:25:34.644070+00:00", "status_notes": "Vulnerability CVE-2025-43864 affects version 7.18.1-tuxcare.1 of react-router.", "vulnerability": { "name": "CVE-2025-43864" }, "action_statement": "Vulnerability CVE-2025-43864 affects version 7.18.1-tuxcare.1 of react-router." }, { "status": "affected", "products": [ { "@id": "pkg:npm/react-router@7.18.1-tuxcare.1", "identifiers": { "purl": "pkg:npm/react-router@7.18.1-tuxcare.1" } } ], "timestamp": "2026-10-30T14:25:00.217895+00:00", "status_notes": "Vulnerability CVE-2025-43865 affects version 7.18.1-tuxcare.1 of react-router.", "vulnerability": { "name": "CVE-2025-43865" }, "action_statement": "Vulnerability CVE-2025-43865 affects version 7.18.1-tuxcare.1 of react-router." }, { "status": "affected", "products": [ { "@id": "pkg:npm/react-router@7.18.1-tuxcare.1", "identifiers": { "purl": "pkg:npm/react-router@7.18.1-tuxcare.1" } } ], "timestamp": "2026-10-30T14:47:00.151806+00:00", "status_notes": "Vulnerability CVE-2025-59057 affects version 7.18.1-tuxcare.1 of react-router.", "vulnerability": { "name": "CVE-2025-59057" }, "action_statement": "Vulnerability CVE-2025-59057 affects version 7.18.1-tuxcare.1 of react-router." }, { "status": "affected", "products": [ { "@id": "pkg:npm/react-router@7.18.1-tuxcare.1", "identifiers": { "purl": "pkg:npm/react-router@7.18.1-tuxcare.1" } } ], "timestamp": "2026-10-30T14:47:00.151806+00:00", "status_notes": "Vulnerability CVE-2026-22029 affects version 7.18.1-tuxcare.1 of react-router.", "vulnerability": { "name": "CVE-2026-22029" }, "action_statement": "Vulnerability CVE-2026-22029 affects version 7.18.1-tuxcare.1 of react-router." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/react-router@7.18.1-tuxcare.1", "identifiers": { "purl": "pkg:npm/react-router@7.18.1-tuxcare.1" } } ], "timestamp": "2026-11-04T00:29:32.716116+00:00", "status_notes": "Vulnerability CVE-2026-22030 does not affect version 7.18.1-tuxcare.1 of react-router. not_affected \u2014 CVE-2026-22030 describes a CSRF vulnerability allowing cross-origin POST requests to execute server-side action handlers in React Router Framework Mode. The target repository (react-router v7.18.1-tuxcare.1) is NOT AFFECTED because the upstream fix was already present in the shipped version. The CSRF defense function `throwIfPotentialCSRFAttack` validates that the request's origin header matche...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-22030" }, "impact_statement": "not_affected \u2014 CVE-2026-22030 describes a CSRF vulnerability allowing cross-origin POST requests to execute server-side action handlers in React Router Framework Mode. The target repository (react-router v7.18.1-tuxcare.1) is NOT AFFECTED because the upstream fix was already present in the shipped version. The CSRF defense function `throwIfPotentialCSRFAttack` validates that the request's origin header matche..." }, { "status": "affected", "products": [ { "@id": "pkg:npm/react-router@7.18.1-tuxcare.1", "identifiers": { "purl": "pkg:npm/react-router@7.18.1-tuxcare.1" } } ], "timestamp": "2026-10-30T14:49:00.106665+00:00", "status_notes": "Vulnerability CVE-2026-42211 affects version 7.18.1-tuxcare.1 of react-router.", "vulnerability": { "name": "CVE-2026-42211" }, "action_statement": "Vulnerability CVE-2026-42211 affects version 7.18.1-tuxcare.1 of react-router." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/react-router@7.18.1-tuxcare.1", "identifiers": { "purl": "pkg:npm/react-router@7.18.1-tuxcare.1" } } ], "timestamp": "2026-11-04T00:34:56.138110+00:00", "status_notes": "Vulnerability CVE-2026-53668 does not affect version 7.18.1-tuxcare.1 of react-router. not_affected \u2014 The target version 7.18.1 is not affected by CVE-2026-53668. The vulnerability (open redirect via protocol-relative URLs) was already fixed in the upstream release by commit 3a5b5ad0e, which added double-slash normalization to prevent URLs like `//evil.com` from being treated as external redirects. The fix converts such inputs to internal paths like `/evil.com`.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-53668" }, "impact_statement": "not_affected \u2014 The target version 7.18.1 is not affected by CVE-2026-53668. The vulnerability (open redirect via protocol-relative URLs) was already fixed in the upstream release by commit 3a5b5ad0e, which added double-slash normalization to prevent URLs like `//evil.com` from being treated as external redirects. The fix converts such inputs to internal paths like `/evil.com`." }, { "status": "fixed", "products": [ { "@id": "pkg:npm/react-router@7.18.1-tuxcare.1", "identifiers": { "purl": "pkg:npm/react-router@7.18.1-tuxcare.1" } } ], "timestamp": "2026-10-03T18:45:00.710705+00:00", "status_notes": "Vulnerability GHSA-qwww-vcr4-c8h2 is fixed in version 7.18.1-tuxcare.1 of react-router.", "vulnerability": { "name": "GHSA-qwww-vcr4-c8h2" } } ] }