Skip to content
OpenAdvisories
High · 7.5 Public exploit CVE-2025-31137 EUVD-2025-9433GHSA-4q56-crqp-v477

Remix and React Router allow URL manipulation via Host / X-Forwarded-Host headers

Published Apr 1, 2025 · Updated Apr 2, 2025 · Assigned by GitHub_M

Vendor: remix-run Product: react-router Package: @react-router/express Package: @remix-run/express Ecosystem: npm

Description

React Router is a multi-strategy router for React bridging the gap from React 18 to React 19. There is a vulnerability in Remix/React Router that affects all Remix 2 and React Router 7 consumers using the Express adapter. Basically, this vulnerability allows anyone to spoof the URL used in an incoming Request by putting a URL pathname in the port section of a URL that is part of a Host or X-Forwarded-Host header sent to a Remix/React Router request handler. This issue has been patched and released in Remix 2.16.3 and React Router 7.4.1.

Affected products

VendorProductAffectedFixed
remix-run react-router >= 7.0.0, < 7.4.1, >= 2.11.1, < 2.16.3 —

Public exploits

Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.

Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.

GitHub 1 repository

Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.

Affected packages

EcosystemPackageAffectedFixedRecord
npm @react-router/express >= 7.0.0, < 7.4.1 7.4.1 GHSA-4q56-crqp-v477
npm @remix-run/express >= 2.11.1, < 2.16.3 2.16.3 GHSA-4q56-crqp-v477

References