{
  "@id": "urn:uuid:42387f3b-fce0-4dd4-9e79-c1d35ba7828d",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 12,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-06T11:23:00.043341+00:00",
  "statements": [
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/react-router@7.13.1",
          "identifiers": {
            "purl": "pkg:npm/react-router@7.13.1"
          }
        }
      ],
      "timestamp": "2026-10-30T14:25:34.644070+00:00",
      "status_notes": "Vulnerability CVE-2025-43864 affects version 7.13.1 of react-router.",
      "vulnerability": {
        "name": "CVE-2025-43864"
      },
      "action_statement": "Vulnerability CVE-2025-43864 affects version 7.13.1 of react-router."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/react-router@7.13.1",
          "identifiers": {
            "purl": "pkg:npm/react-router@7.13.1"
          }
        }
      ],
      "timestamp": "2026-10-30T14:25:00.217895+00:00",
      "status_notes": "Vulnerability CVE-2025-43865 affects version 7.13.1 of react-router.",
      "vulnerability": {
        "name": "CVE-2025-43865"
      },
      "action_statement": "Vulnerability CVE-2025-43865 affects version 7.13.1 of react-router."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/react-router@7.13.1",
          "identifiers": {
            "purl": "pkg:npm/react-router@7.13.1"
          }
        }
      ],
      "timestamp": "2026-10-30T14:47:00.151806+00:00",
      "status_notes": "Vulnerability CVE-2025-59057 affects version 7.13.1 of react-router.",
      "vulnerability": {
        "name": "CVE-2025-59057"
      },
      "action_statement": "Vulnerability CVE-2025-59057 affects version 7.13.1 of react-router."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/react-router@7.13.1",
          "identifiers": {
            "purl": "pkg:npm/react-router@7.13.1"
          }
        }
      ],
      "timestamp": "2026-10-30T14:47:00.151806+00:00",
      "status_notes": "Vulnerability CVE-2026-22029 affects version 7.13.1 of react-router.",
      "vulnerability": {
        "name": "CVE-2026-22029"
      },
      "action_statement": "Vulnerability CVE-2026-22029 affects version 7.13.1 of react-router."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/react-router@7.13.1",
          "identifiers": {
            "purl": "pkg:npm/react-router@7.13.1"
          }
        }
      ],
      "timestamp": "2026-11-04T00:26:27.945159+00:00",
      "status_notes": "Vulnerability CVE-2026-22030 does not affect version 7.13.1 of react-router. not_affected \u2014 The target repository (React Router 7.13.1-tuxcare.3) is NOT affected by CVE-2026-22030. The CSRF protection fix was already included in the upstream React Router 7.13.1 release before TuxCare onboarded it. The defense mechanism (origin header validation via throwIfPotentialCSRFAttack) is present and properly integrated in all three server-side action entry points (server.ts, single-fetch.ts, s...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-22030"
      },
      "impact_statement": "not_affected \u2014 The target repository (React Router 7.13.1-tuxcare.3) is NOT affected by CVE-2026-22030. The CSRF protection fix was already included in the upstream React Router 7.13.1 release before TuxCare onboarded it. The defense mechanism (origin header validation via throwIfPotentialCSRFAttack) is present and properly integrated in all three server-side action entry points (server.ts, single-fetch.ts, s..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/react-router@7.13.1",
          "identifiers": {
            "purl": "pkg:npm/react-router@7.13.1"
          }
        }
      ],
      "timestamp": "2026-11-04T17:53:00.040676+00:00",
      "status_notes": "Vulnerability CVE-2026-33244 affects version 7.13.1 of react-router, and is fixed in 7.13.1-tuxcare.4.",
      "vulnerability": {
        "name": "CVE-2026-33244"
      },
      "action_statement": "Vulnerability CVE-2026-33244 affects version 7.13.1 of react-router, and is fixed in 7.13.1-tuxcare.4."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/react-router@7.13.1",
          "identifiers": {
            "purl": "pkg:npm/react-router@7.13.1"
          }
        }
      ],
      "timestamp": "2026-10-16T23:19:00.195712+00:00",
      "status_notes": "Vulnerability CVE-2026-33245 affects version 7.13.1 of react-router, and is fixed in 7.13.1-tuxcare.1.",
      "vulnerability": {
        "name": "CVE-2026-33245"
      },
      "action_statement": "Vulnerability CVE-2026-33245 affects version 7.13.1 of react-router, and is fixed in 7.13.1-tuxcare.1."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/react-router@7.13.1",
          "identifiers": {
            "purl": "pkg:npm/react-router@7.13.1"
          }
        }
      ],
      "timestamp": "2026-10-16T23:19:00.195712+00:00",
      "status_notes": "Vulnerability CVE-2026-34077 affects version 7.13.1 of react-router, and is fixed in 7.13.1-tuxcare.1.",
      "vulnerability": {
        "name": "CVE-2026-34077"
      },
      "action_statement": "Vulnerability CVE-2026-34077 affects version 7.13.1 of react-router, and is fixed in 7.13.1-tuxcare.1."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/react-router@7.13.1",
          "identifiers": {
            "purl": "pkg:npm/react-router@7.13.1"
          }
        }
      ],
      "timestamp": "2026-10-16T23:19:00.195712+00:00",
      "status_notes": "Vulnerability CVE-2026-40181 affects version 7.13.1 of react-router, and is fixed in 7.13.1-tuxcare.1.",
      "vulnerability": {
        "name": "CVE-2026-40181"
      },
      "action_statement": "Vulnerability CVE-2026-40181 affects version 7.13.1 of react-router, and is fixed in 7.13.1-tuxcare.1."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/react-router@7.13.1",
          "identifiers": {
            "purl": "pkg:npm/react-router@7.13.1"
          }
        }
      ],
      "timestamp": "2026-10-27T11:56:30.168532+00:00",
      "status_notes": "Vulnerability CVE-2026-42211 affects version 7.13.1 of react-router, and is fixed in 7.13.1-tuxcare.2.",
      "vulnerability": {
        "name": "CVE-2026-42211"
      },
      "action_statement": "Vulnerability CVE-2026-42211 affects version 7.13.1 of react-router, and is fixed in 7.13.1-tuxcare.2."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/react-router@7.13.1",
          "identifiers": {
            "purl": "pkg:npm/react-router@7.13.1"
          }
        }
      ],
      "timestamp": "2026-11-04T17:53:00.040676+00:00",
      "status_notes": "Vulnerability CVE-2026-42342 affects version 7.13.1 of react-router, and is fixed in 7.13.1-tuxcare.4.",
      "vulnerability": {
        "name": "CVE-2026-42342"
      },
      "action_statement": "Vulnerability CVE-2026-42342 affects version 7.13.1 of react-router, and is fixed in 7.13.1-tuxcare.4."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/react-router@7.13.1",
          "identifiers": {
            "purl": "pkg:npm/react-router@7.13.1"
          }
        }
      ],
      "timestamp": "2026-10-27T11:56:30.168532+00:00",
      "status_notes": "Vulnerability CVE-2026-53663 affects version 7.13.1 of react-router, and is fixed in 7.13.1-tuxcare.2.",
      "vulnerability": {
        "name": "CVE-2026-53663"
      },
      "action_statement": "Vulnerability CVE-2026-53663 affects version 7.13.1 of react-router, and is fixed in 7.13.1-tuxcare.2."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/react-router@7.13.1",
          "identifiers": {
            "purl": "pkg:npm/react-router@7.13.1"
          }
        }
      ],
      "timestamp": "2026-10-27T11:56:30.168532+00:00",
      "status_notes": "Vulnerability CVE-2026-53666 affects version 7.13.1 of react-router, and is fixed in 7.13.1-tuxcare.2.",
      "vulnerability": {
        "name": "CVE-2026-53666"
      },
      "action_statement": "Vulnerability CVE-2026-53666 affects version 7.13.1 of react-router, and is fixed in 7.13.1-tuxcare.2."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/react-router@7.13.1",
          "identifiers": {
            "purl": "pkg:npm/react-router@7.13.1"
          }
        }
      ],
      "timestamp": "2026-10-27T11:56:30.168532+00:00",
      "status_notes": "Vulnerability CVE-2026-53667 affects version 7.13.1 of react-router, and is fixed in 7.13.1-tuxcare.2.",
      "vulnerability": {
        "name": "CVE-2026-53667"
      },
      "action_statement": "Vulnerability CVE-2026-53667 affects version 7.13.1 of react-router, and is fixed in 7.13.1-tuxcare.2."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/react-router@7.13.1",
          "identifiers": {
            "purl": "pkg:npm/react-router@7.13.1"
          }
        }
      ],
      "timestamp": "2026-11-04T00:37:00.052574+00:00",
      "status_notes": "Vulnerability CVE-2026-53668 does not affect version 7.13.1 of react-router. not_affected \u2014 The target repository (@remix-run/react-router 7.13.1-tuxcare.3) is NOT affected by CVE-2026-53668. The vulnerability\u2014an open redirect via protocol-less absolute URLs (e.g., //evil.com) bypassing path normalization\u2014has been fixed by upstream commit 3a5b5ad0e authored by Matt Brophy. This fix was already present in the upstream release 7.13.1 before TuxCare onboarded the version. The vulnerable ...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-53668"
      },
      "impact_statement": "not_affected \u2014 The target repository (@remix-run/react-router 7.13.1-tuxcare.3) is NOT affected by CVE-2026-53668. The vulnerability\u2014an open redirect via protocol-less absolute URLs (e.g., //evil.com) bypassing path normalization\u2014has been fixed by upstream commit 3a5b5ad0e authored by Matt Brophy. This fix was already present in the upstream release 7.13.1 before TuxCare onboarded the version. The vulnerable ..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/react-router@7.13.1",
          "identifiers": {
            "purl": "pkg:npm/react-router@7.13.1"
          }
        }
      ],
      "timestamp": "2026-10-27T11:56:30.168532+00:00",
      "status_notes": "Vulnerability CVE-2026-53669 affects version 7.13.1 of react-router, and is fixed in 7.13.1-tuxcare.2.",
      "vulnerability": {
        "name": "CVE-2026-53669"
      },
      "action_statement": "Vulnerability CVE-2026-53669 affects version 7.13.1 of react-router, and is fixed in 7.13.1-tuxcare.2."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/react-router@7.13.1",
          "identifiers": {
            "purl": "pkg:npm/react-router@7.13.1"
          }
        }
      ],
      "timestamp": "2026-11-06T11:23:00.043341+00:00",
      "status_notes": "Vulnerability CVE-2026-55685 affects version 7.13.1 of react-router, and is fixed in 7.13.1-tuxcare.5.",
      "vulnerability": {
        "name": "CVE-2026-55685"
      },
      "action_statement": "Vulnerability CVE-2026-55685 affects version 7.13.1 of react-router, and is fixed in 7.13.1-tuxcare.5."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/react-router@7.13.1",
          "identifiers": {
            "purl": "pkg:npm/react-router@7.13.1"
          }
        }
      ],
      "timestamp": "2026-10-27T18:27:31.961988+00:00",
      "status_notes": "Vulnerability GHSA-qwww-vcr4-c8h2 affects version 7.13.1 of react-router, and is fixed in 7.13.1-tuxcare.3.",
      "vulnerability": {
        "name": "GHSA-qwww-vcr4-c8h2"
      },
      "action_statement": "Vulnerability GHSA-qwww-vcr4-c8h2 affects version 7.13.1 of react-router, and is fixed in 7.13.1-tuxcare.3."
    }
  ]
}