Remix and React Router allow URL manipulation via Host / X-Forwarded-Host headers
Priority LOW 35CWE-444Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- None · None · High
- Fix status
- Partial Red Hat: 1 without a fix
Attack profile from CVSS 3.0 · CNA. Fix status from CNA, GitHub and Red Hat.
Summary
React Router is a multi-strategy router for React bridging the gap from React 18 to React 19. There is a vulnerability in Remix/React Router that affects all Remix 2 and React Router 7 consumers using the Express adapter. Basically, this vulnerability allows anyone to spoof the URL used in an incoming Request by putting a URL pathname in the port section of a URL that is part of a Host or X-Forwarded-Host header sent to a Remix/React Router request handler. This issue has been patched and released in Remix 2.16.3 and React Router 7.4.1.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.01191 68th percentileScored 2026-11-07
Fix Partial react-router (remix-run): 7.4.1, 2.16.3@react-router/express (npm): 7.4.1+1 more productRed Hat: 1 without a fix
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| remix-run | react-router | 7.0.0 to before 7.4.1; 2.11.1 to before 2.16.3 | 7.4.1, 2.16.3 | Patch available | CNA |
| — | @react-router/express (npm) | 7.0.0 to before 7.4.1 | 7.4.1 | Patch available | GHSA-4q56-crqp-v477 |
| — | @remix-run/express (npm) | 2.11.1 to before 2.16.3 | 2.16.3 | Patch available | GHSA-4q56-crqp-v477 |
- react-router Vendorremix-run Affected 7.0.0 to before 7.4.1; 2.11.1 to before 2.16.3 Fixed in 7.4.1, 2.16.3 Patch available CNA
- @react-router/express (npm) Vendor— Affected 7.0.0 to before 7.4.1 Fixed in 7.4.1 Patch available GHSA-4q56-crqp-v477
- @remix-run/express (npm) Vendor— Affected 2.11.1 to before 2.16.3 Fixed in 2.16.3 Patch available GHSA-4q56-crqp-v477
Remediation
- Fix · CNA react-router (remix-run) Fixed in 7.4.1, 2.16.3
- Fix · GHSA-4q56-crqp-v477 @react-router/express (npm) Fixed in 7.4.1 Advisory →
- Fix · GHSA-4q56-crqp-v477 @remix-run/express (npm) Fixed in 2.16.3 Advisory →
Vendor assessments
Red Hat
Red Hat rating: Important. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat OpenShift AI (RHOAI) | Affected | No fix yet |
Not affected: 36 products
- Cryostat 4
- Logging Subsystem for Red Hat OpenShift
- Migration Toolkit for Applications 7
- Migration Toolkit for Containers
- Migration Toolkit for Virtualization
- Multicluster Engine for Kubernetes
- Network Observability Operator
- OpenShift Pipelines
- OpenShift Serverless
- OpenShift Service Mesh 2
- OpenShift Service Mesh 3
- Red Hat Advanced Cluster Management for Kubernetes 2
- Red Hat Advanced Cluster Security 4
- Red Hat Ansible Automation Platform 2
- Red Hat Data Grid 8
- Red Hat Developer Hub 1
- Red Hat Discovery 1
- Red Hat Edge Manager preview
- Red Hat Enterprise Linux 8
- Red Hat Fuse 7
- Red Hat Integration Camel K 1
- Red Hat JBoss Enterprise Application Platform 8
- Red Hat JBoss Enterprise Application Platform Expansion Pack
- Red Hat OpenShift AI (RHOAI)
- Red Hat OpenShift Container Platform 4
- Red Hat OpenShift Dev Spaces
- Red Hat OpenShift GitOps
- Red Hat OpenShift Virtualization 4
- Red Hat Openshift Data Foundation 4
- Red Hat Process Automation 7
- Red Hat Quay 3
- Red Hat Single Sign-On 7
- Red Hat Trusted Profile Analyzer
- Red Hat build of Apache Camel - HawtIO 4
- Red Hat build of Apicurio Registry 2
- Red Hat build of OptaPlanner 8
Timeline
- 2026-10-02 Threatist record created from CVE-2025-31137
- 2026-10-03 Alias added: GHSA-4q56-crqp-v477
- 2026-10-27 Affected versions changed · Red Hat
References
More remix-run vulnerabilities
- TI-2025-28449 React Router allows pre-render data spoofing on React-Router framework mode CVSS 3.1HIGH 8.2
- TI-2025-28448 React Router allows a DoS via cache poisoning by forcing SPA mode CVSS 3.1HIGH 7.5
- TI-2025-38117 React Router has Path Traversal in File Session Storage CVSS 3.1CRITICAL 9.1
- TI-2026-40200 React Router: Unauthenticated Denial of Service via Inefficient Route Matching CVSS 4.0HIGH 8.7
- TI-2025-33550 Job Iteration API is vulnerable to OS Command Injection attack through its CsvEnumerator class CVSS 4.0HIGH 8.1
- TI-2026-26385 Ruby LSP has arbitrary code execution through branch setting CVSS 4.0HIGH 7.1
Sources
- CVE-2025-31137 · CVE Program
- CVE-2025-31137 · NVD
- FIRST EPSS
- GHSA-4q56-crqp-v477 · GitHub Advisory Database · CC BY 4.0
- CVE-2025-31137 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences