React Router allows pre-render data spoofing on React-Router framework mode
Priority HIGH 75CWE-345Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- None · Low · High
- Fix status
- Partial Red Hat: 1 fixed, 1 without a fix
Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-345.
Summary
React Router is a router for React. In versions on the 7.0 branch prior to version 7.5.2, it's possible to modify pre-rendered data by adding a header to the request. This allows to completely spoof its contents and modify all the values of the data object passed to the HTML. This issue has been patched in version 7.5.2.
Why it matters now
Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00815 57th percentileScored 2026-11-07
Fix Partial react-router (remix-run): 7.5.2react-router (npm): 7.5.2Red Hat: 1 advisoryRed Hat: 1 fixed, 1 without a fix
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| remix-run | react-router | 7.0 to before 7.5.2 | 7.5.2 | Patch available | CNA |
| — | react-router (npm) | 7.0.0-pre.0 to before 7.5.2 | 7.5.2 | Patch available | GHSA-cpj6-fhp6-mr6j |
- react-router Vendorremix-run Affected 7.0 to before 7.5.2 Fixed in 7.5.2 Patch available CNA
- react-router (npm) Vendor— Affected 7.0.0-pre.0 to before 7.5.2 Fixed in 7.5.2 Patch available GHSA-cpj6-fhp6-mr6j
Remediation
- Fix · CNA react-router (remix-run) Fixed in 7.5.2
- Fix · GHSA-cpj6-fhp6-mr6j react-router (npm) Fixed in 7.5.2 Advisory →
Red Hat 1 advisory
- RHSA-2025:13904 Released 2025-08-14 · Red Hat rating ModerateRHOAI 2.23.0 - Red Hat OpenShift AI
- Red Hat OpenShift AI 2.23 registry.redhat.io/rhoai/odh-dashboard-rhel9
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat OpenShift AI (RHOAI) | Affected | No fix yet |
| Red Hat OpenShift AI 2.23 | Fixed | RHSA-2025:13904 |
Not affected: 21 products
- Cryostat 3
- Cryostat 4
- Network Observability Operator
- OpenShift Lightspeed
- OpenShift Serverless
- Red Hat Ansible Automation Platform 2
- Red Hat Data Grid 8
- Red Hat Developer Hub 1
- Red Hat Enterprise Linux 8
- Red Hat Fuse 7
- Red Hat Integration Camel K 1
- Red Hat JBoss Enterprise Application Platform 8
- Red Hat JBoss Enterprise Application Platform Expansion Pack
- Red Hat OpenShift AI (RHOAI)
- Red Hat OpenShift AI 2.23
- Red Hat OpenShift distributed tracing 3
- Red Hat Process Automation 7
- Red Hat Single Sign-On 7
- Red Hat build of Apache Camel - HawtIO 4
- Red Hat build of Apicurio Registry 2
- Red Hat build of OptaPlanner 8
Timeline
- 2026-10-02 Threatist record created from CVE-2025-43865
- 2026-10-03 Alias added: GHSA-cpj6-fhp6-mr6j
- 2026-10-16 Affected versions changed · Red Hat
- 2026-10-27 Affected versions changed · Red Hat
References
Other 4
- https://github.com/remix-run/react-router/security/advisories/GHSA-cpj6-fhp6-mr6j
- https://github.com/remix-run/react-router/commit/c84302972a152d851cf5dd859ff332b354b70111
- https://github.com/remix-run/react-router/blob/e6c53a0130559b4a9bd47f9cf76ea5b08a69868a/packages/react-router/lib/server-runtime/routes.ts#L87
- https://github.com/remix-run/react-router
More remix-run vulnerabilities
- TI-2025-28448 React Router allows a DoS via cache poisoning by forcing SPA mode CVSS 3.1HIGH 7.5
- TI-2025-38117 React Router has Path Traversal in File Session Storage CVSS 3.1CRITICAL 9.1
- TI-2026-40200 React Router: Unauthenticated Denial of Service via Inefficient Route Matching CVSS 4.0HIGH 8.7
- TI-2025-33550 Job Iteration API is vulnerable to OS Command Injection attack through its CsvEnumerator class CVSS 4.0HIGH 8.1
- TI-2026-26385 Ruby LSP has arbitrary code execution through branch setting CVSS 4.0HIGH 7.1
- TI-2026-30645 React Router vulnerable to DoS via unbounded path expansion in __manifest endpoint CVSS 3.1HIGH 7.5
Sources
- CVE-2025-43865 · CVE Program
- CVE-2025-43865 · NVD
- FIRST EPSS
- GHSA-cpj6-fhp6-mr6j · GitHub Advisory Database · CC BY 4.0
- CVE-2025-43865 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences