CVE-2025-43865: React Router allows pre-render data spoofing on React-Router framework mode
(updated )
After some research, it turns out that it’s possible to modify pre-rendered data by adding a header to the request. This allows to completely spoof its contents and modify all the values of the data object passed to the HTML. Latest versions are impacted.
References
- github.com/advisories/GHSA-cpj6-fhp6-mr6j
- github.com/remix-run/react-router
- github.com/remix-run/react-router/blob/e6c53a0130559b4a9bd47f9cf76ea5b08a69868a/packages/react-router/lib/server-runtime/routes.ts
- github.com/remix-run/react-router/commit/c84302972a152d851cf5dd859ff332b354b70111
- github.com/remix-run/react-router/security/advisories/GHSA-cpj6-fhp6-mr6j
- nvd.nist.gov/vuln/detail/CVE-2025-43865
Code Behaviors & Features
Detect and mitigate CVE-2025-43865 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →