Search for packages
| purl | pkg:npm/react-router@7.0.0-pre.5 |
| Vulnerability | Summary | Fixed by |
|---|---|---|
|
VCID-fvgg-y3kj-wyew
Aliases: CVE-2025-43865 GHSA-cpj6-fhp6-mr6j |
React Router allows pre-render data spoofing on React-Router framework mode ## Summary After some research, it turns out that it's possible to modify pre-rendered data by adding a header to the request. This allows to completely spoof its contents and modify all the values of the data object passed to the HTML. Latest versions are impacted. ## Details The vulnerable header is `X-React-Router-Prerender-Data`, a specific JSON object must be passed to it in order for the spoofing to be successful as we will see shortly. Here is [the vulnerable code](https://github.com/remix-run/react-router/blob/e6c53a0130559b4a9bd47f9cf76ea5b08a69868a/packages/react-router/lib/server-runtime/routes.ts#L87) : <img width="776" alt="Capture d’écran 2025-04-07 à 05 36 58" src="https://github.com/user-attachments/assets/c95b0b33-15ce-4d30-9f5e-b10525dd6ab4" /> To use the header, React-router must be used in Framework mode, and for the attack to be possible the target page must use a loader. ## Steps to reproduce Versions used for our PoC: - "@react-router/node": "^7.5.0", - "@react-router/serve": "^7.5.0", - "react": "^19.0.0" - "react-dom": "^19.0.0" - "react-router": "^7.5.0" 1. Install React-Router with its default configuration in Framework mode (https://reactrouter.com/start/framework/installation) 2. Add a simple page using a loader (example: `routes/ssr`) 3. Access your page (*which uses the loader*) by suffixing it with `.data`. In our case the page is called `/ssr`:  We access it by adding the suffix `.data` and retrieve the data object, needed for the header:  4. Send your request by adding the `X-React-Router-Prerender-Data` header with the previously retrieved object as its value. You can change any value of your `data` object (do not touch the other values, the latter being necessary for the object to be processed correctly and not throw an error):  As you can see, all values have been changed/overwritten by the values provided via the header. ## Impact The impact is significant, if a cache system is in place, it is possible to poison a response in which all of the data transmitted via a loader would be altered by an attacker allowing him to take control of the content of the page and modify it as he wishes via a cache-poisoning attack. This can lead to several types of attacks including potential stored XSS depending on the context in which the data is injected and/or how the data is used on the client-side. ## Credits - Rachid Allam (zhero;) - Yasser Allam (inzo_) |
Affected by 5 other vulnerabilities. |
| Vulnerability | Summary | Aliases |
|---|---|---|
| This package is not known to fix vulnerabilities. | ||
| Date | Actor | Action | Vulnerability | Source | VulnerableCode Version |
|---|---|---|---|---|---|
| 2026-04-29T22:08:43.724907+00:00 | GitLab Importer | Affected by | VCID-fvgg-y3kj-wyew | https://gitlab.com/gitlab-org/advisories-community/-/blob/main/npm/react-router/CVE-2025-43865.yml | 38.5.0 |
| 2026-04-16T23:27:19.563276+00:00 | GitLab Importer | Affected by | VCID-fvgg-y3kj-wyew | https://gitlab.com/gitlab-org/advisories-community/-/blob/main/npm/react-router/CVE-2025-43865.yml | 38.4.0 |
| 2026-04-12T00:46:50.035364+00:00 | GitLab Importer | Affected by | VCID-fvgg-y3kj-wyew | https://gitlab.com/gitlab-org/advisories-community/-/blob/main/npm/react-router/CVE-2025-43865.yml | 38.3.0 |
| 2026-04-03T00:54:49.951005+00:00 | GitLab Importer | Affected by | VCID-fvgg-y3kj-wyew | https://gitlab.com/gitlab-org/advisories-community/-/blob/main/npm/react-router/CVE-2025-43865.yml | 38.1.0 |