CVE-2025-43865

Published: Apr 25, 2025Modified: Jun 17, 2026Deferred

8.2

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H

Exploitability: 3.9 / Impact: 4.2

Source: security-advisories@github.com (Secondary)

Description

React Router is a router for React. In versions on the 7.0 branch prior to version 7.5.2, it's possible to modify pre-rendered data by adding a header to the request. This allows to completely spoof its contents and modify all the values of the data object passed to the HTML. This issue has been patched in version 7.5.2.

Related CWEs

CWE-345

Insufficient Verification of Data Authenticity

The product does not sufficiently verify the origin or authenticity of data, in a way that causes it to accept invalid data.

References (3)

https://github.com/remix-run/react-router/blob/e6c53a0130559b4a9bd47f9cf76ea5b08a69868a/packages/react-router/lib/server-runtime/routes.ts#L87

Source: security-advisories@github.com

https://github.com/remix-run/react-router/commit/c84302972a152d851cf5dd859ff332b354b70111

Source: security-advisories@github.com

https://github.com/remix-run/react-router/security/advisories/GHSA-cpj6-fhp6-mr6j

Source: security-advisories@github.com

Timeline

No history available yet.