PT-2025-17868 · Unknown · React Router

Cold-Try

·

Published

2025-04-24

·

Updated

2025-12-04

·

CVE-2025-43865

CVSS v3.1

8.2

High

VectorAV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H
Name of the Vulnerable Software and Affected Versions React Router versions 7.0 through 7.5.1
Description The issue allows an attacker to modify pre-rendered data by adding a header to the request, potentially leading to various exploits, including stored XSS. This is possible due to a vulnerability in React Router, which is a router for React. The vulnerability can be exploited by adding a header to the request, allowing an attacker to completely spoof the contents and modify all the values of the data object passed to the HTML.
Recommendations For React Router versions 7.0 through 7.5.1, update to version 7.5.2 to resolve the issue. As a temporary workaround, consider restricting access to the vulnerable module or disabling the ability to add headers to requests until a patch is available. Avoid using the vulnerable versions of React Router until the issue is resolved.

Exploit

Fix

Insufficient Verification of Data Authenticity

Weakness Enumeration

CWE-345

Related Identifiers

CVE-2025-43865
GHSA-CPJ6-FHP6-MR6J

Affected Products

React Router