Vulnerability · Published Apr 25, 2025 · Assigned by GitHub_M
CVE-2025-43865React Router allows pre-render data spoofing on React-Router framework mode
High 8.2
In plain English
A high-severity insufficient verification of data authenticity in react-router from remix-run. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.8% (higher than 57% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code. Fixed versions are available - upgrade the affected package.
Official description
React Router is a router for React. In versions on the 7.0 branch prior to version 7.5.2, it's possible to modify pre-rendered data by adding a header to the request. This allows to completely spoof its contents and modify all the values of the data object passed to the HTML. This issue has been patched in version 7.5.2.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| npm | react-router | 7.5.2 | GHSA-cpj6-fhp6-mr6j |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| remix-run | react-router | >= 7.0, < 7.5.2 |
Weakness: CWE-345 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H
References
- https://github.com/remix-run/react-router/security/advisories/GHSA-cpj6-fhp6-mr6j x_refsource_CONFIRM
- https://github.com/remix-run/react-router/commit/c84302972a152d851cf5dd859ff332b354b70111 x_refsource_MISC
- https://github.com/remix-run/react-router/blob/e6c53a0130559b4a9bd47f9cf76ea5b08a69868a/packages/react-router/lib/server-runtime/routes.ts#L87 x_refsource_MISC