# CVE-2025-43865: React Router pre-render data spoofing in framework mode

Source: https://junglewise.ai/threats/cve-2025-43865-react-router-pre-render-data-spoofing-in-framework-mode  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2025-04-24. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2025-43865 · Severity: low · CVSS 3.1 · Published 2025-04-24

React Router is a routing library used to build web applications with dynamic page navigation. In framework mode with pre-rendered pages, an attacker can inject a malicious HTTP header to forge the data sent to browsers, enabling cache poisoning and potential malicious content injection (such as XSS). If a cache layer is deployed, the poisoned response affects all subsequent users visiting the page.

Technologies: [React-Router](https://junglewise.ai/threats/technologies/npm-react-router).

## Quick answers

**Is CVE-2025-43865 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2025-43865 being exploited in the wild.

**How severe is CVE-2025-43865?** Low severity, with a CVSS score of 3.1, published 24 April 2025.

**Which products and versions are affected?** React-Router SEMVER:introduced=7.0.0-pre.0,fixed=7.5.2.

**Is there a fix for CVE-2025-43865?** Yes. React-Router: upgrade to 7.5.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2025-43865 attacked?** It is attacked over the network.

**Am I affected by CVE-2025-43865?** Check whether you run React-Router at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- React-Router: upgrade to 7.5.2 or later

## Technical details

The vulnerability is an insufficient input validation issue in React Router's framework mode that processes the X-React-Router-Prerender-Data HTTP header. When a route uses a loader to fetch data, an unauthenticated network attacker can craft a request with this header containing a JSON object that completely overwrites the legitimate pre-rendered data object passed to the HTML. This requires the application to be in React Router framework mode and the target page must have a loader configured. The attack enables cache-poisoning attacks and can lead to stored XSS if the spoofed data is rendered without sanitization. The fix was released in version 7.5.2.

## Affected products

- Remix React Router 7.0.0 through 7.5.1

## Identifiers

- CVE-2025-43865
- GHSA-cpj6-fhp6-mr6j

## Timeline

- 2025-04-24: disclosed
- 2025-04-24: patched: Version 7.5.2 released

## References

- [https://github.com/remix-run/react-router/security/advisories/GHSA-cpj6-fhp6-mr6j](https://github.com/remix-run/react-router/security/advisories/GHSA-cpj6-fhp6-mr6j)

## Related threats

- [remix-run react-router resource consumption in manifest endpoint](https://junglewise.ai/threats/cve-2026-55685-remix-run-react-router-resource-consumption-in-manifest-endpoint)
- [Remix React Router open redirect in Link and useNavigate](https://junglewise.ai/threats/cve-2026-53669-remix-react-router-open-redirect-in-link-and-usenavigate)
- [remix-run React Router improper protocol validation in RSCErrorHandler](https://junglewise.ai/threats/cve-2026-53667-remix-run-react-router-improper-protocol-validation-in)
- [remix-run React Router unsafe reflection in SSR hydration](https://junglewise.ai/threats/cve-2026-53666-remix-run-react-router-unsafe-reflection-in-ssr-hydration)
- [React Router CSRF bypass in RSC mode](https://junglewise.ai/threats/react-router-csrf-bypass-in-rsc-mode-0018662d)