p PatchFirst

PatchFirst · Latest vulnerabilities

@remix-run/express vulnerabilities

Vulnerabilities published for @remix-run/express in the last 30 days: 0. Listed in the KEV catalogue: 0.

RSS ↗ JSON ↗
Filter vulnerabilities
Clear filters

Vulnerability: 1

  1. CVE-2025-31137

    High · CVSS 7.5EPSS 1.19%Fix available

    Remix and React Router allow URL manipulation via Host / X-Forwarded-Host headers

    React Router is a multi-strategy router for React bridging the gap from React 18 to React 19. There is a vulnerability in Remix/React Router that affects all Remix 2 and React Router 7 consumers using the Express adapter. Basically, this vulnerability allows anyone to spoof the URL used in an incoming Request by putting a URL pathname in the port section of a URL that is part of a Host or X-Forwarded-Host header sent to a Remix/React Router request handler. This issue has been patched and released in Remix 2.16.3 and React Router 7.4.1.

    @remix-run/expressNode.js
    • Update to 2.16.3
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗

Check your server

Check your installed stack and versions against the current vulnerability feeds.

Check your server →