GitHub Advisoryadvisory · npm

GHSA-4q56-crqp-v477 Remix and React Router allow URL manipulation via Host / X-Forwarded-Host headers

HIGH Published 2025-04-01 Modified 2025-04-01 Official page ↗
Aliases
CVE-2025-31137
Ecosystem
npm
Packages
@react-router/express, @remix-run/express
Severity
High
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weaknesses
CWE-444
Reviewed
2025-04-01

Affected packages

• npm @react-router/express: >= 7.0.0, < 7.4.1 → fixed in 7.4.1 • npm @remix-run/express: >= 2.11.1, < 2.16.3 → fixed in 2.16.3

Description

Impact We received a report about a vulnerability in Remix/React Router that affects all Remix 2 and React Router 7 consumers using the Express adapter. Basically, this vulnerability allows anyone to spoof the URL used in an incoming `Request` by putting a URL pathname in the port section of a URL that is part of a `Host` or `X-Forwarded-Host` header sent to a Remix/React Router request handler. Patches This issue has been patched and released in Remix 2.16.3 React Router 7.4.1. Credits • Rachid Allam (zhero;) • Yasser Allam (inzo_)

Related

Alias · CVE (1)

  • CVE-2025-31137 React Router is a multi-strategy router for React bridging the gap from React 18 to React 19. vulnerability

Weakness · CWE (1)

  • CWE-444 Inconsistent Interpretation of HTTP Requests weakness

References