Skip to content
OpenAdvisories

Package · npm

react-router

20 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

3 results · Clear filters · Feed

  • High 7.6
    CVE-2025-59057 Public exploit

    React Router has XSS Vulnerability

    React Router is a router for React. In @remix-run/react versions 1.15.0 through 2.17.0. and react-router versions 7.0.0 through 7.8.2, a XSS vulnerability exists in in React Router's meta()/<Meta> APIs in Framework Mode when generating script:ld+json tags whi…

    remix-run react-router react-router @remix-run/react npm
  • High 8.2
    CVE-2025-43865 Public exploit

    React Router allows pre-render data spoofing on React-Router framework mode

    React Router is a router for React. In versions on the 7.0 branch prior to version 7.5.2, it's possible to modify pre-rendered data by adding a header to the request. This allows to completely spoof its contents and modify all the values ​​of the data object …

    remix-run react-router react-router npm
  • High 7.5
    CVE-2025-43864 Public exploit EPSS 20%

    React Router allows a DoS via cache poisoning by forcing SPA mode

    React Router is a router for React. Starting in version 7.2.0 and prior to version 7.5.2, it is possible to force an application to switch to SPA mode by adding a header to the request. If the application uses SSR and is forced to switch to SPA, this causes a…

    remix-run react-router react-router npm