Vulnerability · Published Apr 25, 2025 · Assigned by GitHub_M
CVE-2025-43864React Router allows a DoS via cache poisoning by forcing SPA mode
High 7.5
In plain English
A high-severity security flaw in react-router from remix-run. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 20.5% (higher than 98% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code. Fixed versions are available - upgrade the affected package.
Official description
React Router is a router for React. Starting in version 7.2.0 and prior to version 7.5.2, it is possible to force an application to switch to SPA mode by adding a header to the request. If the application uses SSR and is forced to switch to SPA, this causes an error that completely corrupts the page. If a cache system is in place, this allows the response containing the error to be cached, resulting in a cache poisoning that strongly impacts the availability of the application. This issue has been patched in version 7.5.2.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| npm | react-router | 7.5.2 | GHSA-f46r-rw29-r322 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| remix-run | react-router | >= 7.2.0, < 7.5.2 |
Weakness: CWE-755 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
References
- https://github.com/remix-run/react-router/security/advisories/GHSA-f46r-rw29-r322 x_refsource_CONFIRM
- https://github.com/remix-run/react-router/commit/c84302972a152d851cf5dd859ff332b354b70111 x_refsource_MISC
- https://github.com/remix-run/react-router/blob/e6c53a0130559b4a9bd47f9cf76ea5b08a69868a/packages/react-router/lib/server-runtime/server.ts#L407 x_refsource_MISC