React Router is vulnerable to a denial‑of‑service attack caused by unbounded path expansion in its __manifest endpoint. Crafted requests trigger excessive server resource consumption, resulting in significant response time slowdowns and possible service unavailability for end users. The weakness, identified as CWE-400 (Uncontrolled Resource Consumption), provides attackers with the ability to degrade application performance without altering data or compromising credentials.

The issue affects Remix-run’s @remix-run/server-runtime versions 2.10.0 through 2.17.4 and react‑router versions 7.0.0 through 7.14.x. Applications running React Router in Framework Mode or as part of a Remix project are affected, while projects using Declarative Mode (BrowserRouter) or Data Mode (createBrowserRouter/RouterProvider) are not impacted.

The vulnerability is assigned a CVSS score of 7.5, indicating high severity. No EPSS score is available, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is a remote HTTP request to the __manifest endpoint; given the lack of authentication or other controls, an attacker can send crafted requests from the public internet to exhaust server resources.