CVE-2025-43865: React Router pre-render data spoofing in framework mode

CVE-2025-43865 · Severity: low · CVSS 3.1 · Published 2025-04-24

React Router is a routing library used to build web applications with dynamic page navigation. In framework mode with pre-rendered pages, an attacker can inject a malicious HTTP header to forge the data sent to browsers, enabling cache poisoning and potential malicious content injection (such as XSS). If a cache layer is deployed, the poisoned response affects all subsequent users visiting the page.

Technologies: React-Router.

Quick answers

Is CVE-2025-43865 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2025-43865 being exploited in the wild.
How severe is CVE-2025-43865?
Low severity, with a CVSS score of 3.1, published 24 April 2025.
Which products and versions are affected?
React-Router SEMVER:introduced=7.0.0-pre.0,fixed=7.5.2.
Is there a fix for CVE-2025-43865?
Yes. React-Router: upgrade to 7.5.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2025-43865 attacked?
It is attacked over the network.
Am I affected by CVE-2025-43865?
Check whether you run React-Router at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • React-Router: upgrade to 7.5.2 or later

Technical details

The vulnerability is an insufficient input validation issue in React Router's framework mode that processes the X-React-Router-Prerender-Data HTTP header. When a route uses a loader to fetch data, an unauthenticated network attacker can craft a request with this header containing a JSON object that completely overwrites the legitimate pre-rendered data object passed to the HTML. This requires the application to be in React Router framework mode and the target page must have a loader configured. The attack enables cache-poisoning attacks and can lead to stored XSS if the spoofed data is rendered without sanitization. The fix was released in version 7.5.2.

Affected products

  • Remix React Router 7.0.0 through 7.5.1

Identifiers

  • CVE-2025-43865
  • GHSA-cpj6-fhp6-mr6j

Timeline

  • 2025-04-24: disclosed
  • 2025-04-24: patched: Version 7.5.2 released

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.