CVE-2025-31137

Published Apr 1, 2025

Last updated 3 months ago

JavaScript

React

Overview

AI description

Automated description summarized from trusted sources.

CVE-2025-31137 is a vulnerability found in React Router, specifically affecting Remix 2 and React Router 7 users utilizing the Express adapter. This flaw allows attackers to manipulate the URL pathname by exploiting the Host or X-Forwarded-Host headers in HTTP requests. By inserting a URL pathname in the port section of these headers, attackers can spoof the URL used in incoming requests. This vulnerability can lead to various exploits, including cache poisoning denial of service (CPDoS), WAF bypass, and escalated XSS attacks. The issue stems from the lack of port sanitization in React Router's Express adapter when handling the Host and X-Forwarded-Host headers. The vulnerability has been addressed in Remix 2.16.3 and React Router 7.4.1.

Description: React Router is a multi-strategy router for React bridging the gap from React 18 to React 19. There is a vulnerability in Remix/React Router that affects all Remix 2 and React Router 7 consumers using the Express adapter. Basically, this vulnerability allows anyone to spoof the URL used in an incoming Request by putting a URL pathname in the port section of a URL that is part of a Host or X-Forwarded-Host header sent to a Remix/React Router request handler. This issue has been patched and released in Remix 2.16.3 and React Router 7.4.1.
Source: security-advisories@github.com
NVD status: Awaiting Analysis

Risk scores

CVSS 3.0

Type: Secondary
Base score: 7.5
Impact score: 3.6
Exploitability score: 3.9
Vector string: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Severity: HIGH

Weaknesses

security-advisories@github.com: CWE-444

Hype score: Not currently trending

References