Asymmetric denial of service - ReDoS In react-router
Description
React Router vulnerable to DoS via unbounded path expansion in __manifest endpoint There exists a potential DOS attack vector in React Router Framework Mode applications (as well as Remix v2.10.0 - 2.17.4). Certain requests can be crafted to consume disproportionate resources on the server, resulting in response time degredation and/or service unavailability for end users.
[!NOTE] This does not impact your React Router application if you are using Declarative Mode (
<BrowserRouter>) or Data Mode (createBrowserRouter/<RouterProvider>).
Mitigation
Update Impact
Minimal update. May introduce new vulnerabilities or breaking changes.
Ecosystem | Package | Affected version | Patched versions |
|---|---|---|---|
 npm | 7.15.0 | ||
npm | 2.17.5 |
Aliases
1. 2. 3. 4. 5.
References
1.