CVE-2025-31137

published 2025-04-01

CVE-2025-31137: React Router is a multi-strategy router for React bridging the gap from React 18 to React 19. There is a vulnerability in Remix/React Router that affects all…

Priority P3 43 high 7.5 CVSS 3.0

AV N AC L PR N UI N S U C N I N A H

React Router is a multi-strategy router for React bridging the gap from React 18 to React 19. There is a vulnerability in Remix/React Router that affects all Remix 2 and React Router 7 consumers using the Express adapter. Basically, this vulnerability allows anyone to spoof the URL used in an incoming Request by putting a URL pathname in the port section of a URL that is part of a Host or X-Forwarded-Host header sent to a Remix/React Router request handler. This issue has been patched and released in Remix 2.16.3 and React Router 7.4.1.

Affected

4 ranges

Vendor	Product	Version range	Fixed in
react-router	express	>= 7.0.0 < 7.4.1	7.4.1
remix-run	express	>= 2.11.1 < 2.16.3	2.16.3
remix-run	react-router	—	—
remix-run	react-router	—	—

CVSS provenance

nvd v3.0 7.5 HIGH CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

vendor_redhat 7.5 HIGH

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-444