@accounter/client (>=0.0.4-alpha-20250218215417-09067250dfe59d52ff05e9ab3ed5ed3c462043f4, <=0.0.5-alpha-20250505082538-38c58bebc71a033977733a447a842c7e011f7c8f), @boxyhq/react-ui (3.4.0) +73 more potentially affected by CVE-2025-43864 via react-router (>=7.2.0, <=7.5.1)

react-router NPM version =7.2.0, =0.0.4-alpha-20250218215417-09067250dfe59d52ff05e9ab3ed5ed3c462043f4, =0.2.3, =15.2.2, =0.0.1-ssmch, =0.0.1-dev.8, =0.0.1-0, =0.0.1-alpha.6, =16.0.29, =0.0.1, =13.271.0, =0.0.2, =13.34.0, =0.3.4, =0.7.116 and more Source cves: CVE-2025-43864 Source advisory:...

PT-2025-17868

Name of the Vulnerable Software and Affected Versions React Router versions 7.0 through 7.5.1 Description The issue allows an attacker to modify pre-rendered data by adding a header to the request, potentially leading to various exploits, including stored XSS. This is possible due to a...

PT-2025-17867

Name of the Vulnerable Software and Affected Versions React Router versions 7.2.0 through 7.5.2 Description The issue allows an attacker to force an application to switch to SPA mode by adding a header to the request. If the application uses SSR and is forced to switch to SPA, this causes an erro...

PT-2025-51546

Уязвимость пакета npm React Router связана с недостаточной обработкой исключительных состояний. Эксплуатация уязвимости может позволить нарушителю, действующему удаленно, вызвать отказ в обслуживании...

CVE-2025-31137

React Router is a multi-strategy router for React bridging the gap from React 18 to React 19. There is a vulnerability in Remix/React Router that affects all Remix 2 and React Router 7 consumers using the Express adapter. Basically, this vulnerability allows anyone to spoof the URL used in an...

Remix and React Router allow URL manipulation via Host / X-Forwarded-Host headers

Impact We received a report about a vulnerability in Remix/React Router that affects all Remix 2 and React Router 7 consumers using the Express adapter. Basically, this vulnerability allows anyone to spoof the URL used in an incoming Request by putting a URL pathname in the port section of a URL...

GHSA-4Q56-CRQP-V477 Remix and React Router allow URL manipulation via Host / X-Forwarded-Host headers

Impact We received a report about a vulnerability in Remix/React Router that affects all Remix 2 and React Router 7 consumers using the Express adapter. Basically, this vulnerability allows anyone to spoof the URL used in an incoming Request by putting a URL pathname in the port section of a URL...

@diffuse-dev/particles-ui (0.0.53), @react-router/serve (>=7.0.0, <=7.4.1-pre.0) +2 more potentially affected by CVE-2025-31137 via @react-router/express (>=7.0.0, <=7.4.1-pre.0)

@react-router/express NPM version =7.0.0, =7.0.0, =0.1.0-xyd.22, =0.1.0-xyd.20, =0.1.0-xyd.29 Source cves: CVE-2025-31137 Source advisory: GHSA-4Q56-CRQP-V477...

@diffuse-dev/particles-ui (0.0.53), @react-router/serve (>=7.0.0, <=7.4.1-pre.0) +2 more potentially affected by CVE-2025-31137 via @react-router/express (>=7.0.0, <=7.4.1-pre.0)

@react-router/express NPM version =7.0.0, =7.0.0, =0.1.0-xyd.22, =0.1.0-xyd.20, =0.1.0-xyd.29 Source cves: CVE-2025-31137 Source advisory: OSV:GHSA-4Q56-CRQP-V477...

CVE-2025-31137

React Router is a multi-strategy router for React bridging the gap from React 18 to React 19. There is a vulnerability in Remix/React Router that affects all Remix 2 and React Router 7 consumers using the Express adapter. Basically, this vulnerability allows anyone to spoof the URL used in an...

CVE-2025-31137

Summary: A Host/X-Forwarded-Host header manipulation vulnerability in Remix/React Router affects Remix 2 and React Router 7 users using the Express adapter. An attacker can spoof the incoming Request URL by placing a pathname in the URL’s port section of a header-hosted URL, potentially altering ...

CVE-2025-31137 Remix and React Router allow URL manipulation via Host / X-Forwarded-Host headers

React Router is a multi-strategy router for React bridging the gap from React 18 to React 19. There is a vulnerability in Remix/React Router that affects all Remix 2 and React Router 7 consumers using the Express adapter. Basically, this vulnerability allows anyone to spoof the URL used in an...

CVE-2025-31137

React Router is a multi-strategy router for React bridging the gap from React 18 to React 19. There is a vulnerability in Remix/React Router that affects all Remix 2 and React Router 7 consumers using the Express adapter. Basically, this vulnerability allows anyone to spoof the URL used in an...

CVE-2025-31137 Remix and React Router allow URL manipulation via Host / X-Forwarded-Host headers

React Router is a multi-strategy router for React bridging the gap from React 18 to React 19. There is a vulnerability in Remix/React Router that affects all Remix 2 and React Router 7 consumers using the Express adapter. Basically, this vulnerability allows anyone to spoof the URL used in an...

@diffuse-dev/particles-ui (0.0.53), @react-router/serve (>=7.0.0, <=7.4.1-pre.0) +2 more potentially affected by CVE-2025-31137 via @react-router/express (>=7.0.0, <=7.4.1-pre.0)

@react-router/express NPM version =7.0.0, =7.0.0, =0.1.0-xyd.22, =0.1.0-xyd.20, =0.1.0-xyd.29 Source cves: CVE-2025-31137 Source advisory: MEND:CVE-2025-31137...

CVE-2025-31137 Remix and React Router allow URL manipulation via Host / X-Forwarded-Host headers

React Router is a multi-strategy router for React bridging the gap from React 18 to React 19. There is a vulnerability in Remix/React Router that affects all Remix 2 and React Router 7 consumers using the Express adapter. Basically, this vulnerability allows anyone to spoof the URL used in an...

PT-2025-53558

Уязвимость адаптера Express библиотеки маршрутизации React Router react-фреймворка Remix связана с недостатками обработки HTTP-запросов. Эксплуатация уязвимости может позволить нарушителю, действующему удалённо, вызвать отказ в обслуживании...

React-Router environmental issue vulnerabilities

react-router is a declarative routing for React open-sourced by Remix. An environmental issue vulnerability exists in react-router versions 7.0.0 through 7.4.0, which stems from an Express adapter for Remix or React Router that allows request URLs to be forged via URL pathnames...

PT-2025-14377 · Express +2 · Express +2

Name of the Vulnerable Software and Affected Versions: React Router versions 7.0.0 through 7.4.0 Remix versions 2.11.1 and later, prior to 2.16.3 Description: The issue allows anyone to spoof the URL used in an incoming Request by putting a URL pathname in the port section of a URL that is part o...

CVE-2025-31137: Inconsistent Interpretation of HTTP Requests

React Router is a multi-strategy router for React bridging the gap from React 18 to React 19. There is a vulnerability in Remix/React Router that affects all Remix 2 and React Router 7 consumers using the Express adapter. Basically, this vulnerability allows anyone to spoof the URL used in an...