CVE-2026-42211 - React Router's vendored turbo-stream v2 allows arbitrary constructor invocation via TYPE_ERROR deserialization leading to Unauth RCE
CVE ID :CVE-2026-42211 Published : June 2, 2026, 8:16 p.m. | 57 minutes ago Description :React Router is a router for React. In versions 7.0.0 through 7.14.1, when using Framework Mode, a combination of steps could potentially allow unauthorized remote code execution (RCE) through external...