Executive brief
React Router is a routing library used to build web applications with dynamic page navigation. In framework mode with pre-rendered pages, an attacker can inject a malicious HTTP header to forge the data sent to browsers, enabling cache poisoning and potential malicious content injection (such as XSS). If a cache layer is deployed, the poisoned response affects all subsequent users visiting the page.
Technical details
The vulnerability is an insufficient input validation issue in React Router's framework mode that processes the X-React-Router-Prerender-Data HTTP header. When a route uses a loader to fetch data, an unauthenticated network attacker can craft a request with this header containing a JSON object that completely overwrites the legitimate pre-rendered data object passed to the HTML. This requires the application to be in React Router framework mode and the target page must have a loader configured. The attack enables cache-poisoning attacks and can lead to stored XSS if the spoofed data is rendered without sanitization. The fix was released in version 7.5.2.
Affected products
- Remix React Router 7.0.0 through 7.5.1
Timeline
- 2025-04-24: disclosed
- 2025-04-24: patched: Version 7.5.2 released