CVE-2025-43864

🗓️ 25 Apr 2025 00:18:16Reported by GitHub_MType

cve🔗 web.nvd.nist.gov📰️ 10 Media mentions👁 142 Views

CVE-2025-43864 in React Router allows DoS via cache poisoning when forced to SPA mode.

Reporter	Title	Published	Views	Family All 17
IBM Security Bulletins	Security Bulletin: The following vulnerabilities that can affect IBM Storage Scale and the Management GUI are now included (CVE-2025-48050, CVE-2025-43865 and CVE-2025-43864)	28 Jul 202521:10	–	ibm
IBM Security Bulletins	Security Bulletin: React Router ≤ 7.5.1 Vulnerability Allows SPA Forcing and Cache Poisoning in SSR Applications, which affects IBM watsonx.data	1 Sep 202514:27	–	ibm
Circl	CVE-2025-43864	24 Apr 202514:55	–	circl
CNNVD	react-router 安全漏洞	25 Apr 202500:00	–	cnnvd
Cvelist	CVE-2025-43864 React Router allows a DoS via cache poisoning by forcing SPA mode	25 Apr 202500:18	–	cvelist
EUVD	EUVD-2025-11980	3 Oct 202520:07	–	euvd
Github Security Blog	React Router allows a DoS via cache poisoning by forcing SPA mode	24 Apr 202516:31	–	github
NVD	CVE-2025-43864	25 Apr 202501:15	–	nvd
OSV	CVE-2025-43864 React Router allows a DoS via cache poisoning by forcing SPA mode	25 Apr 202500:18	–	osv
OSV	GHSA-F46R-RW29-R322 React Router allows a DoS via cache poisoning by forcing SPA mode	24 Apr 202516:31	–	osv

Vulners

Node

remix-run react-routerRange7.2.0–7.5.2

[
  {
    "vendor": "remix-run",
    "product": "react-router",
    "versions": [
      {
        "version": ">= 7.2.0, < 7.5.2",
        "status": "affected"
      }
    ]
  }
]

Source	Link
github	www.github.com/remix-run/react-router/security/advisories/GHSA-f46r-rw29-r322
github	www.github.com/remix-run/react-router/commit/c84302972a152d851cf5dd859ff332b354b70111
github	www.github.com/remix-run/react-router/blob/e6c53a0130559b4a9bd47f9cf76ea5b08a69868a/packages/react-router/lib/server-runtime/server.ts

15 Apr 2026 00:35Current

7.6High risk

Vulners AI Score7.6

CVSS 3.17.5

EPSS0.00954

SSVC

CWE-755

cve-2025-43864 react router dos cache poisoning spa mode error availability