The vulnerability of the npm React Router package, related to insufficient handling of exceptional states, allows a violator to trigger a service failure.

🗓️ 16 Dec 2025 00:00:00Reported by FSTEC of Russia — Information Security Threat DatabaseType

bdu_fstec

bdu_fstec🔗 bdu.fstec.ru👁 2 Views

npm React Router vulnerability arises from poor handling of exceptional states and may cause failures.

Reporter	Title	Published	Views	Family All 18
IBM Security Bulletins	Security Bulletin: The following vulnerabilities that can affect IBM Storage Scale and the Management GUI are now included (CVE-2025-48050, CVE-2025-43865 and CVE-2025-43864)	28 Jul 202521:10	–	ibm
IBM Security Bulletins	Security Bulletin: React Router ≤ 7.5.1 Vulnerability Allows SPA Forcing and Cache Poisoning in SSR Applications, which affects IBM watsonx.data	1 Sep 202514:27	–	ibm
Circl	CVE-2025-43864	24 Apr 202514:55	–	circl
CNNVD	react-router 安全漏洞	25 Apr 202500:00	–	cnnvd
CVE	CVE-2025-43864	25 Apr 202500:18	–	cve
Cvelist	CVE-2025-43864 React Router allows a DoS via cache poisoning by forcing SPA mode	25 Apr 202500:18	–	cvelist
EUVD	EUVD-2025-11980	3 Oct 202520:07	–	euvd
Github Security Blog	React Router allows a DoS via cache poisoning by forcing SPA mode	24 Apr 202516:31	–	github
NVD	CVE-2025-43864	25 Apr 202501:15	–	nvd
OSV	CVE-2025-43864 React Router allows a DoS via cache poisoning by forcing SPA mode	25 Apr 202500:18	–	osv

Source	Link
nvd	www.nvd.nist.gov/vuln/detail/CVE-2025-43864
github	www.github.com/remix-run/react-router/blob/e6c53a0130559b4a9bd47f9cf76ea5b08a69868a/packages/react-router/lib/server-runtime/server.ts
github	www.github.com/remix-run/react-router/commit/c84302972a152d851cf5dd859ff332b354b70111
github	www.github.com/remix-run/react-router/security/advisories/GHSA-f46r-rw29-r322
web	www.web.nvd.nist.gov/view/vuln/detail

16 Dec 2025 00:00Current

7High risk

Vulners AI Score7

CVSS 37.5

CVSS 27.8

EPSS0.23628

npm React Router exceptional states remote attacker service failures