CVE-2025-31137

🗓️ 01 Apr 2025 18:20:32Reported by GitHub_MType

cve🔗 web.nvd.nist.gov📰️ 6 Media mentions👁 113 Views

Vulnerability allows URL spoofing via Host/X-Forwarded-Host headers in Remix and React Router.

Reporter	Title	Published	Views	Family All 13
Circl	CVE-2025-31137	1 Apr 202518:32	–	circl
CNNVD	react-router 环境问题漏洞	1 Apr 202500:00	–	cnnvd
Cvelist	CVE-2025-31137 Remix and React Router allow URL manipulation via Host / X-Forwarded-Host headers	1 Apr 202518:20	–	cvelist
EUVD	EUVD-2025-9433	3 Oct 202520:07	–	euvd
Github Security Blog	Remix and React Router allow URL manipulation via Host / X-Forwarded-Host headers	1 Apr 202522:23	–	github
NVD	CVE-2025-31137	1 Apr 202519:15	–	nvd
OSV	CVE-2025-31137 Remix and React Router allow URL manipulation via Host / X-Forwarded-Host headers	1 Apr 202518:20	–	osv
OSV	GHSA-4Q56-CRQP-V477 Remix and React Router allow URL manipulation via Host / X-Forwarded-Host headers	1 Apr 202522:23	–	osv
Positive Technologies	PT-2025-14377 · Express +2 · Express +2	1 Apr 202500:00	–	ptsecurity
RedhatCVE	CVE-2025-31137	3 Apr 202518:30	–	redhatcve

Vulners

Node

remix-run react-routerRange7.0.0–7.4.1

remix-run react-routerRange2.11.1–2.16.3

[
  {
    "vendor": "remix-run",
    "product": "react-router",
    "versions": [
      {
        "version": ">= 7.0.0, < 7.4.1",
        "status": "affected"
      },
      {
        "version": ">= 2.11.1, < 2.16.3",
        "status": "affected"
      }
    ]
  }
]