PT-2025-17867 · Unknown · React Router
Cold-Try
·
Published
2025-04-24
·
Updated
2025-12-04
·
CVE-2025-43864
CVSS v2.0
7.8
High
| Vector | AV:N/AC:L/Au:N/C:N/I:N/A:C |
Name of the Vulnerable Software and Affected Versions
React Router versions 7.2.0 through 7.5.2
Description
The issue allows an attacker to force an application to switch to SPA mode by adding a header to the request. If the application uses SSR and is forced to switch to SPA, this causes an error that completely corrupts the page. If a cache system is in place, this allows the response containing the error to be cached, resulting in a cache poisoning that strongly impacts the availability of the application. The vulnerable header is
X-React-Router-SPA-Mode.Recommendations
To resolve the issue, update React Router to version 7.5.2 or later.
As a temporary workaround, consider disabling the use of the
X-React-Router-SPA-Mode header in React Router to enhance security.
Restrict access to the vulnerable API endpoints to minimize the risk of exploitation.
Avoid using the X-React-Router-SPA-Mode header in requests to affected pages until the issue is resolved.Exploit
Fix
Improper Handling of Exceptional Conditions
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
React Router