fix(router-core): handle excessive parent relative links

[Sheraff]

Summary by CodeRabbit

• Bug Fixes

  • Improved relative path handling to keep navigation safely within the application root.
  • Correctly normalized empty, dot-prefixed, absolute, and parent-directory paths.

• Tests

  • Added regression coverage for root traversal and potentially unsafe-looking URL segments.

[nx-cloud]

View your CI Pipeline Execution ↗ for commit 3de5c4c

Command	Status	Duration	Result
nx affected --targets=test:eslint,test:unit,tes...	✅ Succeeded	12m 15s	View ↗
nx run-many --target=build --exclude=examples/*...	✅ Succeeded	2m 18s	View ↗

---

☁️ Nx Cloud last updated this comment at 2026-08-09 17:36:56 UTC

[github-actions]

🚀 Changeset Version Preview

No changeset entries found. Merging this PR will not cause a version bump for any packages.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: d2f6641a-d1b4-43d3-b5ac-d64b4721879f

📥 Commits

Reviewing files that changed from the base of the PR and between 6f8f534 and 3de5c4c.

📒 Files selected for processing (4)

• packages/react-router/tests/link.test.tsx
• packages/router-core/src/path.ts
• packages/router-core/tests/build-location.test.ts
• packages/router-core/tests/path.test.ts

---

📝 Walkthrough

Walkthrough

resolvePath now prevents relative traversal above the root and treats protocol-like text as pathname content. Regression tests cover path normalization, location building, and generated link hrefs.

Changes

Root-relative path resolution

Layer / File(s)	Summary
Path resolution normalization packages/router-core/src/path.ts, packages/router-core/tests/path.test.ts	resolvePath handles . directly, preserves root boundaries during .. traversal, and keeps javascript: and data: text in the pathname.
Navigation location validation packages/router-core/tests/build-location.test.ts, packages/react-router/tests/link.test.tsx	Tests verify that over-root targets generate rooted pathname, href, and publicHref values.

Estimated code review effort: 2 (Simple) | ~10 minutes

Suggested reviewers: schiller-manuel

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly describes the fix for relative links that traverse above the root, which is the main change in the pull request.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix-router-core-below-zero-relative-links

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

Bundle Size Benchmarks

• Commit: f015e413d436
• Measured at: 2026-08-09T17:25:46.193Z
• Baseline source: history:6f8f534bf3a8
• Dashboard: bundle-size history

The following scenarios have bundle-size changes compared with the baseline:

Scenario	Current (gzip)	Delta vs baseline	Initial gzip	Raw	Brotli	Trend
react-router.minimal	83.92 KiB	+4 B (+0.00%)	83.78 KiB	262.68 KiB	73.02 KiB	██████▁▁▁▁▁▁
react-router.full	87.43 KiB	+3 B (+0.00%)	87.29 KiB	274.40 KiB	76.04 KiB	██████▁▁▁▁▁▁
solid-router.minimal	33.24 KiB	+3 B (+0.01%)	33.12 KiB	96.52 KiB	30.00 KiB	██████▁▁▁▁▁▁
solid-router.full	38.07 KiB	+5 B (+0.01%)	37.94 KiB	111.15 KiB	34.28 KiB	██████▁▁▁▁▁▁
vue-router.minimal	49.53 KiB	+1 B (+0.00%)	49.40 KiB	138.26 KiB	44.63 KiB	██████▁▁▁▁▁▁
vue-router.full	55.10 KiB	+1 B (+0.00%)	54.98 KiB	156.44 KiB	49.64 KiB	██████▁▁▁▁▁▁
react-start.full	99.93 KiB	+6 B (+0.01%)	99.79 KiB	314.61 KiB	86.59 KiB	██████▁▁▁▁▁▁
react-start.rsbuild.minimal	100.07 KiB	+2 B (+0.00%)	99.90 KiB	315.45 KiB	86.30 KiB	▂▂▁▁▂▂▂▂▆███
react-start.rsbuild.minimal-iife	100.47 KiB	+4 B (+0.00%)	100.31 KiB	316.38 KiB	86.67 KiB	▂▂▁▁▂▂▂▂▆███
react-start.rsbuild.full	103.39 KiB	+4 B (+0.00%)	103.22 KiB	325.54 KiB	89.08 KiB	▂▂▁▁▃▃▃▃▆███
solid-start.minimal	46.01 KiB	+1 B (+0.00%)	45.89 KiB	137.57 KiB	40.95 KiB	██████▁▁▁▁▁▁
solid-start.deferred-hydration	49.09 KiB	+4 B (+0.01%)	45.95 KiB	145.04 KiB	43.69 KiB	██████▁▁▁▁▁▁
solid-start.full	51.09 KiB	+3 B (+0.01%)	50.97 KiB	152.96 KiB	45.33 KiB	██████▁▁▁▁▁▁
vue-start.minimal	65.55 KiB	+2 B (+0.00%)	65.42 KiB	189.08 KiB	58.40 KiB	██████▁▁▁▁▁▁
vue-start.full	69.38 KiB	+4 B (+0.01%)	69.25 KiB	201.36 KiB	61.60 KiB	██████▁▁▁▁▁▁

Current gzip tracks all emitted client JS chunks. Initial gzip tracks only the entry/import graph. Trend sparkline is historical current gzip ending with this PR measurement; lower is better.

[pkg-pr-new]

More templates

• tanstack-router-react-example-authenticated-routes
• tanstack-router-react-example-authenticated-routes-firebase
• tanstack-router-react-example-basic
• tanstack-router-react-example-basic-default-search-params
• tanstack-router-react-example-basic-devtools-panel
• tanstack-router-react-example-basic-file-based
• tanstack-router-react-example-basic-non-nested-devtools
• tanstack-router-react-example-react-query
• tanstack-router-react-example-basic-react-query-file-based
• tanstack-router-react-example-basic-ssr-file-based
• tanstack-router-react-example-basic-ssr-streaming-file-based
• tanstack-router-react-example-basic-virtual-file-based
• tanstack-router-react-example-basic-virtual-inside-file-based
• tanstack-router-react-example-deferred-data
• tanstack-router-i18n-paraglide
• tanstack-router-react-example-kitchen-sink
• tanstack-router-react-example-kitchen-sink-file-based
• tanstack-router-react-example-kitchen-sink-react-query
• tanstack-router-react-example-kitchen-sink-react-query-file-based
• tanstack-router-react-example-large-file-based
• tanstack-router-react-example-location-masking
• tanstack-router-react-example-navigation-blocking
• tanstack-router-react-example-quickstart
• tanstack-router-react-example-quickstart-esbuild-file-based
• tanstack-router-react-example-quickstart-file-based
• tanstack-router-react-example-quickstart-rspack-file-based
• tanstack-router-react-example-quickstart-webpack-file-based
• router-monorepo-react-query
• router-mono-simple
• router-mono-simple-lazy
• tanstack-router-react-example-scroll-restoration
• tanstack-search-validator-adapters
• tanstack-start-example-bare
• tanstack-start-example-basic
• tanstack-start-example-basic-auth
• tanstack-router-react-example-basic-authjs
• tanstack-start-example-basic-cloudflare
• tanstack-start-example-basic-react-query
• tanstack-start-example-basic-rsbuild
• tanstack-start-example-basic-static
• tanstack-start-bun-hosting
• tanstack-start-example-clerk-basic
• tanstack-start-example-convex-trellaux
• tanstack-start-example-counter
• tanstack-start-i18n-paraglide
• tanstack-start-example-large
• tanstack-start-example-material-ui
• tanstack-start-example-rscs
• tanstack-start-streaming-data-from-server-functions
• tanstack-start-example-supabase-basic
• tanstack-start-tailwind-v4
• tanstack-start-example-trellaux
• tanstack-start-example-workos
• tanstack-router-react-example-view-transitions
• tanstack-router-react-example-with-framer-motion
• tanstack-router-react-example-with-trpc
• tanstack-router-react-example-with-trpc-react-query
• tanstack-router-solid-example-authenticated-routes
• tanstack-router-solid-example-authenticated-routes-firebase
• tanstack-router-solid-example-basic
• tanstack-router-solid-example-basic-default-search-params
• tanstack-router-solid-example-basic-devtools-panel
• tanstack-router-solid-example-basic-file-based
• tanstack-router-solid-example-basic-non-nested-devtools
• tanstack-router-solid-example-basic-solid-query
• tanstack-router-solid-example-basic-solid-query-file-based
• tanstack-router-solid-example-basic-ssr-file-based
• tanstack-router-solid-example-basic-ssr-streaming-file-based
• tanstack-router-solid-example-basic-virtual-file-based
• tanstack-router-solid-example-basic-virtual-inside-file-based
• tanstack-router-solid-example-deferred-data
• tanstack-router-solid-i18n-paraglide
• tanstack-router-solid-example-kitchen-sink
• tanstack-router-solid-example-kitchen-sink-file-based
• tanstack-router-solid-example-kitchen-sink-solid-query
• tanstack-router-solid-example-kitchen-sink-solid-query-file-based
• tanstack-router-solid-example-large-file-based
• tanstack-router-solid-example-location-masking
• tanstack-router-solid-example-navigation-blocking
• tanstack-router-solid-example-quickstart
• tanstack-router-solid-example-quickstart-esbuild-file-based
• tanstack-router-solid-example-quickstart-file-based
• tanstack-router-solid-example-quickstart-rspack-file-based
• tanstack-router-solid-example-quickstart-webpack-file-based
• @tanstack/router-solid-mono-simple
• router-solid-mono-simple-lazy
• router-solid-monorepo-solid-query
• tanstack-router-solid-example-scroll-restoration
• tanstack-solid-router-search-validator-adapters
• tanstack-solid-start-example-basic
• tanstack-solid-start-example-basic-auth
• tanstack-solid-start-example-basic-authjs
• tanstack-solid-start-example-basic-cloudflare
• tanstack-solid-start-example-basic-netlify
• tanstack-solid-start-example-basic-nitro
• tanstack-start-example-basic-solid-query
• tanstack-solid-start-example-basic-static
• tanstack-solid-start-bun-hosting
• tanstack-solid-start-example-convex-better-auth
• tanstack-solid-start-example-counter
• tanstack-solid-start-i18n-paraglide
• tanstack-solid-start-example-large
• tanstack-solid-start-streaming-data-from-server-functions
• tanstack-solid-start-example-supabase-basic
• tanstack-solid-start-tailwind-v4
• tanstack-router-solid-example-view-transitions
• tanstack-router-solid-example-with-framer-motion
• tanstack-router-solid-example-with-trpc
• tanstack-router-vue-example-basic-jsx
• tanstack-router-vue-example-basic-file-based-jsx
• tanstack-router-vue-example-basic-file-based-sfc

@tanstack/arktype-adapter

npm i https://pkg.pr.new/@tanstack/arktype-adapter@8018

@tanstack/eslint-plugin-router

npm i https://pkg.pr.new/@tanstack/eslint-plugin-router@8018

@tanstack/eslint-plugin-start

npm i https://pkg.pr.new/@tanstack/eslint-plugin-start@8018

@tanstack/history

npm i https://pkg.pr.new/@tanstack/history@8018

@tanstack/nitro-v2-vite-plugin

npm i https://pkg.pr.new/@tanstack/nitro-v2-vite-plugin@8018

@tanstack/react-router

npm i https://pkg.pr.new/@tanstack/react-router@8018

@tanstack/react-router-devtools

npm i https://pkg.pr.new/@tanstack/react-router-devtools@8018

@tanstack/react-router-ssr-query

npm i https://pkg.pr.new/@tanstack/react-router-ssr-query@8018

@tanstack/react-start

npm i https://pkg.pr.new/@tanstack/react-start@8018

@tanstack/react-start-client

npm i https://pkg.pr.new/@tanstack/react-start-client@8018

@tanstack/react-start-rsc

npm i https://pkg.pr.new/@tanstack/react-start-rsc@8018

@tanstack/react-start-server

npm i https://pkg.pr.new/@tanstack/react-start-server@8018

@tanstack/router-cli

npm i https://pkg.pr.new/@tanstack/router-cli@8018

@tanstack/router-core

npm i https://pkg.pr.new/@tanstack/router-core@8018

@tanstack/router-devtools

npm i https://pkg.pr.new/@tanstack/router-devtools@8018

@tanstack/router-devtools-core

npm i https://pkg.pr.new/@tanstack/router-devtools-core@8018

@tanstack/router-generator

npm i https://pkg.pr.new/@tanstack/router-generator@8018

@tanstack/router-plugin

npm i https://pkg.pr.new/@tanstack/router-plugin@8018

@tanstack/router-ssr-query-core

npm i https://pkg.pr.new/@tanstack/router-ssr-query-core@8018

@tanstack/router-utils

npm i https://pkg.pr.new/@tanstack/router-utils@8018

@tanstack/router-vite-plugin

npm i https://pkg.pr.new/@tanstack/router-vite-plugin@8018

@tanstack/solid-router

npm i https://pkg.pr.new/@tanstack/solid-router@8018

@tanstack/solid-router-devtools

npm i https://pkg.pr.new/@tanstack/solid-router-devtools@8018

@tanstack/solid-router-ssr-query

npm i https://pkg.pr.new/@tanstack/solid-router-ssr-query@8018

@tanstack/solid-start

npm i https://pkg.pr.new/@tanstack/solid-start@8018

@tanstack/solid-start-client

npm i https://pkg.pr.new/@tanstack/solid-start-client@8018

@tanstack/solid-start-server

npm i https://pkg.pr.new/@tanstack/solid-start-server@8018

@tanstack/start-client-core

npm i https://pkg.pr.new/@tanstack/start-client-core@8018

@tanstack/start-fn-stubs

npm i https://pkg.pr.new/@tanstack/start-fn-stubs@8018

@tanstack/start-plugin-core

npm i https://pkg.pr.new/@tanstack/start-plugin-core@8018

@tanstack/start-server-core

npm i https://pkg.pr.new/@tanstack/start-server-core@8018

@tanstack/start-static-server-functions

npm i https://pkg.pr.new/@tanstack/start-static-server-functions@8018

@tanstack/start-storage-context

npm i https://pkg.pr.new/@tanstack/start-storage-context@8018

@tanstack/valibot-adapter

npm i https://pkg.pr.new/@tanstack/valibot-adapter@8018

@tanstack/virtual-file-routes

npm i https://pkg.pr.new/@tanstack/virtual-file-routes@8018

@tanstack/vue-router

npm i https://pkg.pr.new/@tanstack/vue-router@8018

@tanstack/vue-router-devtools

npm i https://pkg.pr.new/@tanstack/vue-router-devtools@8018

@tanstack/vue-router-ssr-query

npm i https://pkg.pr.new/@tanstack/vue-router-ssr-query@8018

@tanstack/vue-start

npm i https://pkg.pr.new/@tanstack/vue-start@8018

@tanstack/vue-start-client

npm i https://pkg.pr.new/@tanstack/vue-start-client@8018

@tanstack/vue-start-server

npm i https://pkg.pr.new/@tanstack/vue-start-server@8018

@tanstack/zod-adapter

npm i https://pkg.pr.new/@tanstack/zod-adapter@8018

commit: 3de5c4c

[codspeed-hq]

Merging this PR will regress 0 benchmarks

⚠️ Different runtime environments detected

Some benchmarks with significant performance changes were compared across different runtime environments,
which may affect the accuracy of the results.

Open the report in CodSpeed to investigate

⚡ 1 improved benchmark
❌ 2 (👁 2) regressed benchmarks
✅ 177 untouched benchmarks

Performance Changes

	Mode	Benchmark	BASE	HEAD	Efficiency
⚡	Memory	mem server error-paths not-found (vue)	1,808.8 KB	318.4 KB	×5.7
👁	Memory	mem client navigation-churn (solid)	568.4 KB	636.6 KB	-10.73%
👁	Memory	mem client interrupted-navigations (react)	249.1 KB	281.1 KB	-11.38%

Tip

Curious why this is faster? Comment @codspeedbot explain why this is faster on this PR, or directly use the CodSpeed MCP with your agent.

---

_{Comparing fix-router-core-below-zero-relative-links (3de5c4c) with main (6f8f534)}