React Router is a router for React. In versions 7.0.0 through 7.14.1, when using Framework Mode, a combination of steps could potentially allow unauthorized remote code execution (RCE) through external requests. This attack requires the application code to have an existing prototype pollution vulnerability, which can then be leveraged in a 2-step attack where the second step triggers unauthorized RCE on the remote server. This does not impact applications using Declarative Mode (`<BrowserRouter>`) or Data Mode (`createBrowserRouter/<RouterProvider>`). This is patched in version 7.14.2.

The remote SUSE Linux SLES15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4606-1 advisory.

    golang-github-prometheus-prometheus was updated to version 3.13.2:

    - Security issues:

      * CVE-2026-39821: Fixed validation bypass and privilege escalation in Punycode label handling     (bsc#1266608)
      * CVE-2026-56852: Fixed infinite loop on truncated or invalid UTF-8 input in unicode/norm handling     (bsc#1272102)
      * CVE-2026-44990: Fixed stored XSS in the new React UI by sanitizing disallowed xmp elements     (bsc#1275205)
      * CVE-2026-53606: Fixed incomplete URI scheme validation in sanitize-html that could enable XSS     (bsc#1269966)
      * CVE-2026-2303: Fixed heap out-of-bounds read in GSSAPI error handling in mongo-driver (bsc#1269856)
      * CVE-2025-4673: Fixed credential leaks by stopping HTTP client header forwarding on redirects     (bsc#1275206)
      * CVE-2023-45289: Fixed credential leaks by stopping header and cookie forwarding on HTTP redirects     (bsc#1275207)
      * CVE-2025-61686: Fixed unauthorized file access and path traversal in react-router storage     (bsc#1270711)
      * CVE-2026-40181: Fixed open redirect risks to external domains via relative paths in react-router     (bsc#1267528)
      * CVE-2026-42342: Fixed DoS risks via unbounded path expansion in the manifest endpoint (bsc#1267538)
      * CVE-2026-42211: Fixed remote code execution risks from prototype pollution in react-router     (bsc#1267534)
      * CVE-2026-39882: Fixed memory exhaustion via uncapped HTTP response reading in OpenTelemetry     (bsc#1274221)
      * Fixed potential denial-of-service vulnerabilities by updating the gRPC dependency
      * Fixed memory exhaustion and DoS by rejecting snappy-compressed requests exceeding 32MB limit

    - Bug fixes and changes:

      * Fixed scrape manager failing to reload properly when SD configuration changes rapidly.
      * Prevent memory leak in remote-write path when the receiving endpoint is unavailable.
      * Native Histograms are no longer experimental. They are fully supported for production workloads.
      * Added support for OpenTelemetry traces within the Prometheus UI to correlate metrics and traces.
      * TSDB compaction speed optimized by improving the block merging algorithm.
      * Allow scraping of multiple targets using a single HTTP/2 connection to reduce overhead.
      * Added new metrics to monitor the health of the rule evaluation engine.
      * Incompatible: This affects scraping, remote read and write, alerting, and SD. Network paths might need     adjustments         to avoid redirects.
      * Incompatible: Rule group pagination tokens now use SHA-256 instead of MD5. Custom API consumers must     adapt to the         new longer token format.
      * Added 'group_limit' parameter to PromQL aggregations to restrict the number of results.
      * Incompatible: promtool relative paths in config files now resolve relative to the config directory     itself, instead         of the current working directory.
      * Support exporting TSDB blocks directly to cloud storage via the admin API.
      * Incompatible: Deprecated remote-write metrics like prometheus_remote_storage_samples_total are removed     in favor of         prometheus_wal_watcher_records_read_total.
      * Significant query performance boost for high-cardinality regex matchers.
      * Introduce a new UI interface for safely deleting specific time series data directly.
      * Added dynamic relabeling actions to extract substrings using regex capture groups.
      * Fixed UI displaying incorrect time ranges after a timezone change.
      * Bumped firewalld-prometheus-config to version 0.2 bumping OpenTelemetry to 1.43.0

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to its self-reported version number, the Atlassian Jira application running on the remote host is prior to 10.3.22 or 10.4.x prior to 11.3.7. It is, therefore, affected by multiple vulnerabilities, including flaws in bundled third-party dependencies :

- Multiple server-side request forgery (SSRF) vulnerabilities in the bundled axios dependency. (CVE-2026-42043, CVE-2026-42038)

- A prototype pollution vulnerability in the bundled axios dependency. (CVE-2026-40175)

- An injection vulnerability in the bundled Apache Tomcat dependency. (CVE-2026-41293)

- A broken authentication and session management vulnerability in the bundled Apache Tomcat dependency. (CVE-2026-43512)

- An improper authorization vulnerability in the bundled Apache Tomcat dependency. (CVE-2026-43515)

- Multiple HTTP request smuggling vulnerabilities in the bundled Netty dependency. (CVE-2026-42584, CVE-2026-42585, CVE-2026-33870)

- Multiple injection vulnerabilities in the bundled axios dependency. (CVE-2026-42264, CVE-2026-42035, CVE-2026-42033)

- A denial of service vulnerability in the bundled Netty dependency. (CVE-2026-33871)

- A remote code execution vulnerability in the bundled react-router dependency. (CVE-2026-42211)

- A cross-site scripting (XSS) vulnerability in the bundled turbo-stream dependency. (CVE-2026-34077)

- An information disclosure vulnerability in the bundled Apache Tomcat dependency. (CVE-2026-34487)

- A denial of service vulnerability in the bundled Apache Tomcat dependency. (CVE-2026-41284)

- A denial of service vulnerability in the bundled nth-check dependency. (CVE-2021-3803)

- A business logic vulnerability in the bundled Apache Tomcat dependency. (CVE-2026-43513)

- Multiple denial of service vulnerabilities in the bundled minimatch dependency. (CVE-2026-27903, CVE-2026-27904)

- A denial of service vulnerability in the bundled react-router dependency. (CVE-2026-42342)

- A cryptographic vulnerability in the bundled Apache Tomcat dependency. (CVE-2026-34486)

- A remote code execution vulnerability in the bundled axios dependency. (CVE-2026-44495)

Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - React Router is a router for React. In versions 7.0.0 through 7.14.1, when using Framework Mode, a     combination of steps could potentially allow unauthorized remote code execution (RCE) through external     requests. This attack requires the application code to have an existing prototype pollution vulnerability,     which can then be leveraged in a 2-step attack where the second step triggers unauthorized RCE on the     remote server. This does not impact applications using Declarative Mode (`<BrowserRouter>`) or Data Mode     (`createBrowserRouter/<RouterProvider>`). This is patched in version 7.14.2. (CVE-2026-42211)

Note that Nessus relies on the presence of the package as reported by the vendor.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - React Router is a router for React. In versions 7.0.0 through 7.14.1, when using Framework Mode, a
    combination of steps could potentially allow unauthorized remote code execution (RCE) through external
    requests. This attack requires the application code to have an existing prototype pollution vulnerability,
    which can then be leveraged in a 2-step attack where the second step triggers unauthorized RCE on the
    remote server. This does not impact applications using Declarative Mode (`<BrowserRouter>`) or Data Mode
    (`createBrowserRouter/<RouterProvider>`). This is patched in version 7.14.2. (CVE-2026-42211)

ID	Name	Product	Family	Type	Severity
369278	SUSE SLES15 Security Update : golang-github-prometheus-prometheus (SUSE-SU-2026:4606-1)	Nessus	SuSE Local Security Checks	Local	high
115704	Atlassian Jira 10.4.x < 11.3.7 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	Version Based	high
115703	Atlassian Jira < 10.3.22 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	Version Based	high
341748	Linux Distros Unpatched Vulnerability : CVE-2026-42211	Nessus	Misc.	Local	high
442604	SCA: security update for react-router (GHSA-49rj-9fvp-4h2h)	Tenable Cloud Security	SCA Checks	Local	high
442604	SCA: security update for react-router (GHSA-49rj-9fvp-4h2h)	Tenable Self-Hosted Container Security	SCA Checks	Local	high

Detections

Analytics

CVE-2026-42211

high

Tenable Plugins

high

high

high

high

high

high