CVE-2025-43865

Description

React Router is a router for React. In versions on the 7.0 branch prior to version 7.5.2, it's possible to modify pre-rendered data by adding a header to the request. This allows to completely spoof its contents and modify all the values ​​of the data object passed to the HTML. This issue has been patched in version 7.5.2.

References

https://github.com/remix-run/react-router/security/advisories/GHSA-cpj6-fhp6-mr6j

https://github.com/remix-run/react-router/commit/c84302972a152d851cf5dd859ff332b354b70111

https://github.com/remix-run/react-router/blob/e6c53a0130559b4a9bd47f9cf76ea5b08a69868a/packages/react-router/lib/server-runtime/routes.ts#L87

Details

Source: Mitre, NVD

Risk Information

CVSS v2

CVSS v3

EPSS