I think it was a combination of react-router and react-router-redux, and something I was doing for SSR that led to the issue. The initial fix was just to delete

I think it was a combination of react-router and react-router-redux, and something I was doing for SSR that led to the issue. The initial fix was just to delete the react-router-redux data from the store just before JSON.stringify'ing it. There were a number of weird things that were specific to my usage, so I'm not sure that the vulnerability would be there in a "proper" setup.