404 matches found
React Router allows a DoS via cache poisoning by forcing SPA mode
Summary After some research, it turns out that it is possible to force an application to switch to SPA mode by adding a header to the request. If the application uses SSR and is forced to switch to SPA, this causes an error that completely corrupts the page. If a cache system is in place, this...
PT-2025-17868
Name of the Vulnerable Software and Affected Versions React Router versions 7.0 through 7.5.1 Description The issue allows an attacker to modify pre-rendered data by adding a header to the request, potentially leading to various exploits, including stored XSS. This is possible due to a...
PT-2025-17867
Name of the Vulnerable Software and Affected Versions React Router versions 7.2.0 through 7.5.2 Description The issue allows an attacker to force an application to switch to SPA mode by adding a header to the request. If the application uses SSR and is forced to switch to SPA, this causes an erro...
CVE-2025-31137
React Router is a multi-strategy router for React bridging the gap from React 18 to React 19. There is a vulnerability in Remix/React Router that affects all Remix 2 and React Router 7 consumers using the Express adapter. Basically, this vulnerability allows anyone to spoof the URL used in an...
@akrc/fnpm (=1.13.1), @buttery/studio (>=0.2.3 <=0.3.1) +69 more potentially affected by CVE-2025-31137 via @react-router/express (>=7.0.0 <=7.4.1-pre.0)
@react-router/express NPM version =7.0.0, =0.2.3, =0.1.0, =0.0.1, =2.1.0, =0.3.1, =0.0.13, =1.0.0, =0.0.0-semantically-released, =1.0.1, =6.0.0-canary-001, =6.0.0-canary-001, =6.22.0 and more Source cves: CVE-2025-31137 Source advisory: OSV:GHSA-4Q56-CRQP-V477...
GHSA-4Q56-CRQP-V477 Remix and React Router allow URL manipulation via Host / X-Forwarded-Host headers
Impact We received a report about a vulnerability in Remix/React Router that affects all Remix 2 and React Router 7 consumers using the Express adapter. Basically, this vulnerability allows anyone to spoof the URL used in an incoming Request by putting a URL pathname in the port section of a URL...
Remix and React Router allow URL manipulation via Host / X-Forwarded-Host headers
Impact We received a report about a vulnerability in Remix/React Router that affects all Remix 2 and React Router 7 consumers using the Express adapter. Basically, this vulnerability allows anyone to spoof the URL used in an incoming Request by putting a URL pathname in the port section of a URL...
CVE-2025-31137
React Router is a multi-strategy router for React bridging the gap from React 18 to React 19. There is a vulnerability in Remix/React Router that affects all Remix 2 and React Router 7 consumers using the Express adapter. Basically, this vulnerability allows anyone to spoof the URL used in an...
CVE-2025-31137 Remix and React Router allow URL manipulation via Host / X-Forwarded-Host headers
React Router is a multi-strategy router for React bridging the gap from React 18 to React 19. There is a vulnerability in Remix/React Router that affects all Remix 2 and React Router 7 consumers using the Express adapter. Basically, this vulnerability allows anyone to spoof the URL used in an...
CVE-2025-31137
Summary: A Host/X-Forwarded-Host header manipulation vulnerability in Remix/React Router affects Remix 2 and React Router 7 users using the Express adapter. An attacker can spoof the incoming Request URL by placing a pathname in the URL’s port section of a header-hosted URL, potentially altering ...
CVE-2025-31137 Remix and React Router allow URL manipulation via Host / X-Forwarded-Host headers
React Router is a multi-strategy router for React bridging the gap from React 18 to React 19. There is a vulnerability in Remix/React Router that affects all Remix 2 and React Router 7 consumers using the Express adapter. Basically, this vulnerability allows anyone to spoof the URL used in an...
CVE-2025-31137 Remix and React Router allow URL manipulation via Host / X-Forwarded-Host headers
React Router is a multi-strategy router for React bridging the gap from React 18 to React 19. There is a vulnerability in Remix/React Router that affects all Remix 2 and React Router 7 consumers using the Express adapter. Basically, this vulnerability allows anyone to spoof the URL used in an...
PT-2025-14377 · Express +2 · Express +2
Name of the Vulnerable Software and Affected Versions: React Router versions 7.0.0 through 7.4.0 Remix versions 2.11.1 and later, prior to 2.16.3 Description: The issue allows anyone to spoof the URL used in an incoming Request by putting a URL pathname in the port section of a URL that is part o...
react-router 环境问题漏洞
react-router is a declarative routing for React open-sourced by Remix. An environmental issue vulnerability exists in react-router versions 7.0.0 through 7.4.0, which stems from an Express adapter for Remix or React Router that allows request URLs to be forged via URL pathnames...
Malicious code in meraki-react-router (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 0c83f2848053884da4ed2503526a13acf16087c512c728e406200da4b78084d9 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2024-9004 Malicious code in meraki-react-router (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 0c83f2848053884da4ed2503526a13acf16087c512c728e406200da4b78084d9 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2024-2938 Malicious code in react-router-dom-v7 (npm)
--- -= Per source details. Do not edit below this line.=-...
Malicious code in react-router-dom-v7 (npm)
--- -= Per source details. Do not edit below this line.=-...