React Router versions 7.0.0 through 7.17.0 contain a flaw that allows unauthenticated callers to repeatedly request the manifest endpoint, triggering inefficient route‑matching code that consumes excessive CPU and memory. The resulting load can degrade or block normal traffic, effectively denying service to legitimate users. The issue is unrelated to React Router’s Declarative (<BrowserRouter>) or Data (createBrowserRouter/<RouterProvider>) modes and is a follow‑up to CVE-2026-42342. The weakness is identified with CWE‑400 (Uncontrolled Resource Consumption), CWE‑407 (Inefficient Algorithms), and CWE‑770 (Memory Allocation for Improper Size).

Any deployment that uses Remix Run’s React Router library older than 7.18.0—specifically releases 7.0.0 through 7.17.0—exposes the vulnerable manifest endpoint. Applications built with this legacy component, when exposed to internet traffic, are susceptible to the denial‑of‑service attack described above.

The attack vector is straightforward: an attacker sends unauthenticated HTTP requests to the public manifest endpoint, causing the router to execute the heavy matching routine. Because authentication is not required, the vector is purely network‑based and can be automated at scale. The EPSS score is below 1 %, indicating a very low yet non‑zero likelihood of exploitation, but the CVSS of 8.7 reflects a high potential impact. The vulnerability is not listed in the CISA KEV catalog, yet any exposed application using the affected React Router version can suffer significant downtime.