CVE-2025-31137: Remix and React Router allow URL manipulation via Host / X-Forwarded-Host headers

April 1, 2025

We received a report about a vulnerability in Remix/React Router that affects all Remix 2 and React Router 7 consumers using the Express adapter. Basically, this vulnerability allows anyone to spoof the URL used in an incoming Request by putting a URL pathname in the port section of a URL that is part of a Host or X-Forwarded-Host header sent to a Remix/React Router request handler.

References

github.com/advisories/GHSA-4q56-crqp-v477
github.com/remix-run/react-router
github.com/remix-run/react-router/security/advisories/GHSA-4q56-crqp-v477
nvd.nist.gov/vuln/detail/CVE-2025-31137

Code Behaviors & Features

Detect and mitigate CVE-2025-31137 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →