Executive brief
Remix and React Router are JavaScript frameworks used to build web applications. A vulnerability in their Express adapters allows attackers to spoof the request URL by manipulating Host or X-Forwarded-Host headers, potentially causing application malfunctions or enabling attackers to bypass security checks that rely on correct URL detection. This affects all Remix 2 and React Router 7 applications using the Express adapter.
Technical details
This vulnerability is a request header injection / URL manipulation flaw (CWE-444) affecting the Express adapter in both Remix and React Router. The root cause lies in improper parsing of the Host and X-Forwarded-Host headers, which allows an attacker to inject a URL pathname into the port field of these headers. The vulnerability can be exploited remotely over the network without authentication or user interaction. An attacker can spoof the canonical request URL, which may lead to bypass of security controls that depend on URL validation, incorrect routing decisions, or service disruption. The issue has been patched in Remix 2.16.3 and React Router 7.4.1.
Affected products
- Remix Remix 2.11.1 to 2.16.2
- React Router React Router 7.0.0 to 7.4.0
Timeline
- 2025-04-01: disclosed: Vulnerability published via GHSA-4q56-crqp-v477
- 2025-04-01: patched: Remix 2.16.3 and React Router 7.4.1 released