DoS-via-cache-poisoning-by-forcing-SPA-mode-CVE-2025-43864-

Welcome to React Router! A modern, production-ready template for building full-stack React applications using React Router. Features 🚀 Server-side rendering ⚡️ Hot Module Replacement HMR 📦 Asset bundling and optimization 🔄 Data loading and mutations 🔒 TypeScript by default 🎉 TailwindCSS for stylin...

Security Bulletin: The following vulnerabilities that can affect IBM Storage Scale and the Management GUI are now included (CVE-2025-48050, CVE-2025-43865 and CVE-2025-43864)

Summary The following vulnerabilities that can affect IBM Storage Scale and the Management GUI and could provide weaker than expected security are now fixed CVE-2025-48050, CVE-2025-43865 and CVE-2025-43864. Vulnerability Details CVEID:CVE-2025-48050 DESCRIPTION: In DOMPurify through 3.2.5 before...

CVE-2025-43864

A flaw was found in the React Router. This vulnerability allows an attacker to trigger a rendering error via a crafted X-React-Router-SPA-Mode header, which can result in cache poisoning. If a caching system is in place, the corrupted error response may be cached and served to subsequent users,...

CVE-2025-43864 React Router allows a DoS via cache poisoning by forcing SPA mode

React Router is a router for React. Starting in version 7.2.0 and prior to version 7.5.2, it is possible to force an application to switch to SPA mode by adding a header to the request. If the application uses SSR and is forced to switch to SPA, this causes an error that completely corrupts the...

CVE-2025-43864 React Router allows a DoS via cache poisoning by forcing SPA mode

React Router is a router for React. Starting in version 7.2.0 and prior to version 7.5.2, it is possible to force an application to switch to SPA mode by adding a header to the request. If the application uses SSR and is forced to switch to SPA, this causes an error that completely corrupts the...

CVE-2025-43864

CVE-2025-43864: React Router (versions 7.2.0–7.5.1) allows forcing SPA mode by a request header, which on SSR apps can trigger a page-corrupting error. If a cache stores the error response, this enables cache poisoning and degrades availability. Patch: upgrade to React Router 7.5.2 (or later).

CVE-2025-43864 React Router allows a DoS via cache poisoning by forcing SPA mode

React Router is a router for React. Starting in version 7.2.0 and prior to version 7.5.2, it is possible to force an application to switch to SPA mode by adding a header to the request. If the application uses SSR and is forced to switch to SPA, this causes an error that completely corrupts the...

@accounter/client (>=0.0.4-alpha-20250218215417-09067250dfe59d52ff05e9ab3ed5ed3c462043f4, <=0.0.5-alpha-20250505082538-38c58bebc71a033977733a447a842c7e011f7c8f), @boxyhq/react-ui (3.4.0) +71 more potentially affected by CVE-2025-43864 via react-router (>=7.2.0, <=7.5.1-pre.0)

react-router NPM version =7.2.0, =0.0.4-alpha-20250218215417-09067250dfe59d52ff05e9ab3ed5ed3c462043f4, =0.2.3, =15.2.2, =0.0.1-ssmch, =0.0.1-dev.8, =0.0.1-0, =0.0.1-alpha.6, =16.0.29, =0.0.2, =13.34.0, =0.3.4, =13.33.0, =0.0.11, =0.4.3 and more Source cves: CVE-2025-43864 Source advisory:...