Asymmetric denial of service - ReDoS In react-router
Description
React Router vulnerable to DoS via unbounded path expansion in __manifest endpoint There exists a potential DOS attack vector in React Router Framework Mode applications (as well as Remix v2.10.0 - 2.17.4). Certain requests can be crafted to consume disproportionate resources on the server, resulting in response time degredation and/or service unavailability for end users.
[!NOTE] This does not impact your React Router application if you are using Declarative Mode (
<BrowserRouter>) or Data Mode (createBrowserRouter/<RouterProvider>).
Mitigation
Update Impact
Minimal update. May introduce new vulnerabilities or breaking changes.
Ecosystem | Component | Affected version | Patched versions |
|---|---|---|---|
 npm | 2.17.5 | ||
npm | 7.15.0 | ||
 rpm rhel8 | - | - | |
rpm rhel8 | - | - | |
rpm rhel8 | - | - | |
rpm rhel8 | - | - | |
rpm rhel8 | - | - | |
rpm rhel10 | - | - | |
rpm rhel8 | - | - | |
rpm rhel9 | - | - |
Aliases
References