CVE-2025-43865

Published Apr 25, 2025

Last updated 9 days ago

React Router

Overview

AI description

Automated description summarized from trusted sources.

CVE-2025-43865 is a vulnerability affecting React Router, a routing library for React applications. Specifically, versions on the 7.0 branch prior to 7.5.2 are susceptible. The vulnerability stems from the possibility of modifying pre-rendered data by adding a header to the request. By exploiting this vulnerability, an attacker can completely spoof the contents and modify all the values of the data object passed to the HTML. This is achieved by manipulating the `X-React-Router-Prerender-Data` header. The issue has been addressed and patched in version 7.5.2 of React Router.

Description: React Router is a router for React. In versions on the 7.0 branch prior to version 7.5.2, it's possible to modify pre-rendered data by adding a header to the request. This allows to completely spoof its contents and modify all the values of the data object passed to the HTML. This issue has been patched in version 7.5.2.
Source: security-advisories@github.com
NVD status: Awaiting Analysis

Insights

Analysis from the Intruder Security Team

Published Apr 28, 2025 Updated Apr 28, 2025

If caching is in use on this application, it is likely this can be used to poison the cache, causing the modified data to be shown to other users.

There is also potential to then use this for cross-site scripting, although, this would depend on how the data is processed by the client, and will not be the case for all applications.

In order for this application to be vulnerable, React Router must be used in Framework mode.

Risk scores

CVSS 3.1

Type: Secondary
Base score: 8.2
Impact score: 4.2
Exploitability score: 3.9
Vector string: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H
Severity: HIGH

Weaknesses

security-advisories@github.com: CWE-345

Hype score: Not currently trending

References

Sources include official advisories and independent security research.