p PatchFirst

CVE-2025-43865

CVE-2025-43865 · React Router allows pre-render data spoofing on React-Router framework mode

This page contains facts from public vulnerability sources. Check the original advisory before updating.

React Router is a router for React. In versions on the 7.0 branch prior to version 7.5.2, it's possible to modify pre-rendered data by adding a header to the request. This allows to completely spoof its contents and modify all the values ​​of the data object passed to the HTML. This issue has been patched in version 7.5.2.

CVSS 8.2 · High · EPSS 0.8% · Fix available

Published
Updated

Stack: node

Affected products and versions

  • react-router

    Versions
    • >= 7.0, < 7.5.2: Affected

    No fix published

  • react-router npm

    Affected ranges
    • SEMVER: ≥ 7.0.0-pre.0, < 7.5.2

    Update to 7.5.2

Original sources

Check your server →