{
  "@id": "urn:uuid:9c778880-ab4e-474d-a7fb-e52467fb3eaa",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 9,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-04T00:37:00.052574+00:00",
  "statements": [
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/react-router@7.15.0",
          "identifiers": {
            "purl": "pkg:npm/react-router@7.15.0"
          }
        }
      ],
      "timestamp": "2026-10-30T14:25:34.644070+00:00",
      "status_notes": "Vulnerability CVE-2025-43864 affects version 7.15.0 of react-router.",
      "vulnerability": {
        "name": "CVE-2025-43864"
      },
      "action_statement": "Vulnerability CVE-2025-43864 affects version 7.15.0 of react-router."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/react-router@7.15.0",
          "identifiers": {
            "purl": "pkg:npm/react-router@7.15.0"
          }
        }
      ],
      "timestamp": "2026-10-30T14:25:00.217895+00:00",
      "status_notes": "Vulnerability CVE-2025-43865 affects version 7.15.0 of react-router.",
      "vulnerability": {
        "name": "CVE-2025-43865"
      },
      "action_statement": "Vulnerability CVE-2025-43865 affects version 7.15.0 of react-router."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/react-router@7.15.0",
          "identifiers": {
            "purl": "pkg:npm/react-router@7.15.0"
          }
        }
      ],
      "timestamp": "2026-10-30T14:47:00.151806+00:00",
      "status_notes": "Vulnerability CVE-2025-59057 affects version 7.15.0 of react-router.",
      "vulnerability": {
        "name": "CVE-2025-59057"
      },
      "action_statement": "Vulnerability CVE-2025-59057 affects version 7.15.0 of react-router."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/react-router@7.15.0",
          "identifiers": {
            "purl": "pkg:npm/react-router@7.15.0"
          }
        }
      ],
      "timestamp": "2026-10-30T14:47:00.151806+00:00",
      "status_notes": "Vulnerability CVE-2026-22029 affects version 7.15.0 of react-router.",
      "vulnerability": {
        "name": "CVE-2026-22029"
      },
      "action_statement": "Vulnerability CVE-2026-22029 affects version 7.15.0 of react-router."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/react-router@7.15.0",
          "identifiers": {
            "purl": "pkg:npm/react-router@7.15.0"
          }
        }
      ],
      "timestamp": "2026-11-04T00:26:37.478415+00:00",
      "status_notes": "Vulnerability CVE-2026-22030 does not affect version 7.15.0 of react-router. not_affected \u2014 CVE-2026-22030 (CSRF via missing origin checks) is NOT present in react-router 7.15.0-tuxcare.2. The upstream vendor's fix was already included in the v7.15.0 release that TuxCare onboarded. The defense code `throwIfPotentialCSRFAttack()` exists in packages/react-router/lib/actions.ts and is correctly integrated into all server-side POST request handlers (server.ts, single-fetch.ts, server.rsc....",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-22030"
      },
      "impact_statement": "not_affected \u2014 CVE-2026-22030 (CSRF via missing origin checks) is NOT present in react-router 7.15.0-tuxcare.2. The upstream vendor's fix was already included in the v7.15.0 release that TuxCare onboarded. The defense code `throwIfPotentialCSRFAttack()` exists in packages/react-router/lib/actions.ts and is correctly integrated into all server-side POST request handlers (server.ts, single-fetch.ts, server.rsc...."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/react-router@7.15.0",
          "identifiers": {
            "purl": "pkg:npm/react-router@7.15.0"
          }
        }
      ],
      "timestamp": "2026-10-30T14:49:00.106665+00:00",
      "status_notes": "Vulnerability CVE-2026-42211 affects version 7.15.0 of react-router.",
      "vulnerability": {
        "name": "CVE-2026-42211"
      },
      "action_statement": "Vulnerability CVE-2026-42211 affects version 7.15.0 of react-router."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/react-router@7.15.0",
          "identifiers": {
            "purl": "pkg:npm/react-router@7.15.0"
          }
        }
      ],
      "timestamp": "2026-10-08T13:13:00.146196+00:00",
      "status_notes": "Vulnerability CVE-2026-53663 affects version 7.15.0 of react-router, and is fixed in 7.15.0-tuxcare.1.",
      "vulnerability": {
        "name": "CVE-2026-53663"
      },
      "action_statement": "Vulnerability CVE-2026-53663 affects version 7.15.0 of react-router, and is fixed in 7.15.0-tuxcare.1."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/react-router@7.15.0",
          "identifiers": {
            "purl": "pkg:npm/react-router@7.15.0"
          }
        }
      ],
      "timestamp": "2026-10-08T13:13:00.146196+00:00",
      "status_notes": "Vulnerability CVE-2026-53666 affects version 7.15.0 of react-router, and is fixed in 7.15.0-tuxcare.1.",
      "vulnerability": {
        "name": "CVE-2026-53666"
      },
      "action_statement": "Vulnerability CVE-2026-53666 affects version 7.15.0 of react-router, and is fixed in 7.15.0-tuxcare.1."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/react-router@7.15.0",
          "identifiers": {
            "purl": "pkg:npm/react-router@7.15.0"
          }
        }
      ],
      "timestamp": "2026-10-08T13:13:00.146196+00:00",
      "status_notes": "Vulnerability CVE-2026-53667 affects version 7.15.0 of react-router, and is fixed in 7.15.0-tuxcare.1.",
      "vulnerability": {
        "name": "CVE-2026-53667"
      },
      "action_statement": "Vulnerability CVE-2026-53667 affects version 7.15.0 of react-router, and is fixed in 7.15.0-tuxcare.1."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/react-router@7.15.0",
          "identifiers": {
            "purl": "pkg:npm/react-router@7.15.0"
          }
        }
      ],
      "timestamp": "2026-11-04T00:37:00.052574+00:00",
      "status_notes": "Vulnerability CVE-2026-53668 does not affect version 7.15.0 of react-router. not_affected \u2014 CVE-2026-53668 does not affect react-router version 7.15.0-tuxcare.2. The vulnerability (open redirect via protocol-relative URLs starting with //) was already fixed in the upstream release through commit 3a5b5ad0e by Matt Brophy before TuxCare began maintaining this version branch. The target code contains the removeDoubleSlashes() function that normalizes consecutive slashes, preventing //att...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-53668"
      },
      "impact_statement": "not_affected \u2014 CVE-2026-53668 does not affect react-router version 7.15.0-tuxcare.2. The vulnerability (open redirect via protocol-relative URLs starting with //) was already fixed in the upstream release through commit 3a5b5ad0e by Matt Brophy before TuxCare began maintaining this version branch. The target code contains the removeDoubleSlashes() function that normalizes consecutive slashes, preventing //att..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/react-router@7.15.0",
          "identifiers": {
            "purl": "pkg:npm/react-router@7.15.0"
          }
        }
      ],
      "timestamp": "2026-10-08T13:13:00.146196+00:00",
      "status_notes": "Vulnerability CVE-2026-53669 affects version 7.15.0 of react-router, and is fixed in 7.15.0-tuxcare.1.",
      "vulnerability": {
        "name": "CVE-2026-53669"
      },
      "action_statement": "Vulnerability CVE-2026-53669 affects version 7.15.0 of react-router, and is fixed in 7.15.0-tuxcare.1."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/react-router@7.15.0",
          "identifiers": {
            "purl": "pkg:npm/react-router@7.15.0"
          }
        }
      ],
      "timestamp": "2026-10-16T08:29:00.106630+00:00",
      "status_notes": "Vulnerability CVE-2026-55685 affects version 7.15.0 of react-router, and is fixed in 7.15.0-tuxcare.2.",
      "vulnerability": {
        "name": "CVE-2026-55685"
      },
      "action_statement": "Vulnerability CVE-2026-55685 affects version 7.15.0 of react-router, and is fixed in 7.15.0-tuxcare.2."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/react-router@7.15.0",
          "identifiers": {
            "purl": "pkg:npm/react-router@7.15.0"
          }
        }
      ],
      "timestamp": "2026-10-16T08:29:00.106630+00:00",
      "status_notes": "Vulnerability GHSA-qwww-vcr4-c8h2 affects version 7.15.0 of react-router, and is fixed in 7.15.0-tuxcare.2.",
      "vulnerability": {
        "name": "GHSA-qwww-vcr4-c8h2"
      },
      "action_statement": "Vulnerability GHSA-qwww-vcr4-c8h2 affects version 7.15.0 of react-router, and is fixed in 7.15.0-tuxcare.2."
    }
  ]
}