VulnSocial

CVE-2026-34077Patch(shopify / react-router)

LOWCVSS 7.5 · HIGH

Signal is active with 1 mentions in latest observed window

Immediate actions

  • Patch shopify react-router systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

React Router is a router for React. In versions 7.7.0 through 7.13.1, when using React Router's unstable React Server Components (RSC) APIs, there is a potential client-side Cross-Site Scripting (XSS) vulnerability in the RSC redirect handling if redirects come from untrusted sources. This does not impact applications that are not using the unstable RSC APIs in React Router. This is patched in version 7.13.2.

shopify CVEsBack to dashboard
1.0/ 10 priority

Sources & remediation

Vendor / third-party advisories
Weakness type (CWE)
CWE-770

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

  • react-router
  • turbo_stream

Threat summary

  • Patch or workaround signal is available
  • 3 mentions across 3 observed days
  • Momentum state: stable

What's happening

  • Patch or workaround mentioned in 3 signals
  • Technical details provided in 3 signals
  • Peaked 2d ago at 1 mentions (2026-06-10); latest day: 1
  • 3 total mentions across 3 days

Affected systems

Vendors
shopifyturbo-stream
Products
react-routerturbo_stream

Deep dive

Activity timeline3 mentions / 3d
00111Mentions · 2026-06-10: 1Mentions · 2026-06-28: 1Mentions · 2026-07-25: 1Patch / Workaround · 2026-06-10: 1Patch / Workaround · 2026-06-28: 1Patch / Workaround · 2026-07-25: 1Technical Details · 2026-06-10: 1Technical Details · 2026-06-28: 1Technical Details · 2026-07-25: 106-1006-2807-25
Signal classification1 categories
Patch
3100.0%
Referenced assets1 URL
By indicator
Full discourse3 posts
  • Ferramentas Linux@Cezar_H_Linux
    Patch

    🛡️ #openSUSE-SU-2026:11128-1: Atualização crítica para o Agama Web UI corrige CVE-2026-34077 (XSS no React Router). Saiba mais: -> http://tinyurl.com/vpkyy9nc https://t.co/T1849BveBn

    Post summary

    The text announces a critical patch for the Agama Web UI that resolves an XSS vulnerability in React Router (CVE‑2026‑34077) and provides a link for more information.

    1000066
    1.5K followersView on X
  • DFIR Lab@DFIR_Lab
    Patch

    🚨 HIGH: CVE-2026-34077 (CVSS 7.5) React Router 7.7.0-7.13.1 XSS flaw in unstable RSC APIs. Client-side XSS via untrusted redirects. ✅ Patch: Update to 7.13.2 Only affects RSC API users. #CVE #Vulnerability #PatchNow https://t.co/CPKPDw6oli

    Post summary

    The tweet announces a patch for CVE-2026-34077 in React Router’s unstable RSC APIs, advising users to update to version 7.13.2 to remediate the client‑side XSS flaw.

    0000054
    96 followersView on X
  • Diego Artiles@dartilesm
    Patch

    🚨 React Router: second CVE in a week. CVE-2026-34077 — DoS via single-fetch encoding. Framework Mode only. → v7.0.0–7.13.x affected → createBrowserRouter is safe → Patch: React Router 7.14.0 Patched the RCE last week? Still need this one.

    Post summary

    The tweet announces a second CVE in React Router, details the vulnerability and affected versions, and provides the patch version (7.14.0) for mitigation.

    0000046
    48 followersView on X
CPE platform detail2 entries

2 of 2 entries

PartVendorProductVersionTarget SWTarget HW
Appshopifyreact-router-node.js-
Appturbo-streamturbo_stream-node.js-

Explore more

Back to dashboardshopify CVEsturbo-stream CVEsreact-router vulnerabilities