Vulnerability in Remix-Run React-Router
CVE-2025-43865
React Router is a router for React. In versions on the 7.0 branch prior to version 7.5.2, it's possible to modify pre-rendered data by adding a header to the request. This allows to completely spoof its contents and modify all the values of the data object passed to the HTML. This issue has been patched in version 7.5.2.
EPSS: 0.008 (54.4th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 8.2 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H.
Affected products
- Remix-run React-router — versions >= 7.0, < 7.5.2
Weakness classification (CWE)
Public proof-of-concept exploits
References
- security-advisories@github.com (x_refsource_CONFIRM)
- security-advisories@github.com (x_refsource_MISC)
- security-advisories@github.com (x_refsource_MISC)
Frequently asked questions
- What is CVE-2025-43865?
- CVE-2025-43865 is a high-severity vulnerability in Remix-Run React-Router, classified under Insufficient Verification of Data Authenticity. CVSS score: 8.2/10. Published 2025-04-25.
- How severe is CVE-2025-43865?
- High severity. CVSS v3 base score is 8.2 out of 10.
- Is CVE-2025-43865 known to be exploited?
- 3 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.