{"id":"CVE-2025-43864","aliases":["CLSA-2026-1775521859","CLSA-2026-1792253396","CLSA-2026-1792419110","CLSA-2026-1792419187","CLSA-2026-1792419266","CLSA-2026-1792419622","CLSA-2026-1792421940","CLSA-2026-1792424729","CLSA-2026-1792425404","CLSA-2026-1792428105","CLSA-2026-1792430029","EUVD-2025-11980","GHSA-f46r-rw29-r322"],"status":"published","title":"React Router allows a DoS via cache poisoning by forcing SPA mode","description":"React Router is a router for React. Starting in version 7.2.0 and prior to version 7.5.2, it is possible to force an application to switch to SPA mode by adding a header to the request. If the application uses SSR and is forced to switch to SPA, this causes an error that completely corrupts the page. If a cache system is in place, this allows the response containing the error to be cached, resulting in a cache poisoning that strongly impacts the availability of the application. This issue has been patched in version 7.5.2.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.20475,"percentile":0.97523,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":true},"cwes":["CWE-755"],"published":"2025-04-24T16:31:16Z","modified":"2026-10-30T19:45:52Z","exploits":[{"source":"pocgithub","id":"pouriam23/DoS-via-cache-poisoning-by-forcing-SPA-mode-CVE-2025-43864-","title":"pouriam23/DoS-via-cache-poisoning-by-forcing-SPA-mode-CVE-2025-43864-","date":"2025-04-27","url":"https://github.com/pouriam23/DoS-via-cache-poisoning-by-forcing-SPA-mode-CVE-2025-43864-"}],"fixes":[{"ecosystem":"npm","package":"react-router","fixed_in":["7.5.2"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"react-router","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.2.0"},{"last_affected":"7.5.1"},{"fixed":"7.5.2"}]}]},{"source":"osv","ecosystem":"TuxCare:npm","package":"react-router","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.5.1-tuxcare.0"},{"fixed":"7.5.1-tuxcare.1"}]}],"versions":["7.5.1"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:npm","package":"react-router-dom","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.5.1-tuxcare.0"},{"fixed":"7.5.1-tuxcare.1"}]}],"versions":["7.5.1"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:npm","package":"@react-router/architect","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.5.1-tuxcare.0"},{"fixed":"7.5.1-tuxcare.1"}]}],"versions":["7.5.1"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:npm","package":"@react-router/cloudflare","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.5.1-tuxcare.0"},{"fixed":"7.5.1-tuxcare.1"}]}],"versions":["7.5.1"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:npm","package":"@react-router/express","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.5.1-tuxcare.0"},{"fixed":"7.5.1-tuxcare.1"}]}],"versions":["7.5.1"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:npm","package":"@react-router/node","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.5.1-tuxcare.0"},{"fixed":"7.5.1-tuxcare.1"}]}],"versions":["7.5.1"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:npm","package":"@react-router/remix-routes-option-adapter","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.5.1-tuxcare.0"},{"fixed":"7.5.1-tuxcare.1"}]}],"versions":["7.5.1"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:npm","package":"@react-router/dev","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.5.1-tuxcare.0"},{"fixed":"7.5.1-tuxcare.1"}]}],"versions":["7.5.1"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:npm","package":"@react-router/fs-routes","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.5.1-tuxcare.0"},{"fixed":"7.5.1-tuxcare.1"}]}],"versions":["7.5.1"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:npm","package":"@react-router/serve","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.5.1-tuxcare.0"},{"fixed":"7.5.1-tuxcare.1"}]}],"versions":["7.5.1"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:npm","package":"create-react-router","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.5.1-tuxcare.0"},{"fixed":"7.5.1-tuxcare.1"}]}],"versions":["7.5.1"],"bundled":2},{"source":"osv","ecosystem":"npm","package":"react-router","ranges":[{"type":"SEMVER","events":[{"introduced":"7.2.0"},{"fixed":"7.5.2"}]}]}],"products":[{"vendor":"@tanstack","product":"react-router"},{"vendor":"remix-run","product":"react-router"}],"references":[{"url":"https://github.com/remix-run/react-router/security/advisories/GHSA-f46r-rw29-r322","tags":["x_refsource_CONFIRM","advisory","web"]},{"url":"https://github.com/remix-run/react-router/commit/c84302972a152d851cf5dd859ff332b354b70111","tags":["x_refsource_MISC","fix","web"]},{"url":"https://github.com/remix-run/react-router/blob/e6c53a0130559b4a9bd47f9cf76ea5b08a69868a/packages/react-router/lib/server-runtime/server.ts#L407","tags":["x_refsource_MISC","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-43864","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-f46r-rw29-r322"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/43xxx/CVE-2025-43864.json","tags":["advisory"]},{"url":"https://github.com/remix-run/react-router","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2025-43864","title":"React Router allows a DoS via cache poisoning by forcing SPA mode","description":"React Router is a router for React. Starting in version 7.2.0 and prior to version 7.5.2, it is possible to force an application to switch to SPA mode by adding a header to the request. If the application uses SSR and is forced to switch to SPA, this causes an error that completely corrupts the page. If a cache system is in place, this allows the response containing the error to be cached, resulting in a cache poisoning that strongly impacts the availability of the application. This issue has been patched in version 7.5.2.","status":"published","published":"2025-04-25T00:18:16.058Z","modified":"2025-04-25T15:18:38.495Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-755"],"updated_at":"2026-11-02T14:32:26.964524Z"}],"euvd":[{"id":"EUVD-2025-11980","description":"React Router is a router for React. Starting in version 7.2.0 and prior to version 7.5.2, it is possible to force an application to switch to SPA mode by adding a header to the request. If the application uses SSR and is forced to switch to SPA, this causes an error that completely corrupts the page. If a cache system is in place, this allows the response containing the error to be cached, resulting in a cache poisoning that strongly impacts the availability of the application. This issue has been patched in version 7.5.2.","status":"published","published":"2025-04-25T00:18:16Z","modified":"2025-04-25T15:18:38Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T20:52:02.967137Z"}],"ghsa":[{"id":"GHSA-f46r-rw29-r322","title":"React Router allows a DoS via cache poisoning by forcing SPA mode","description":"## Summary\nAfter some research, it turns out that it is possible to force an application to switch to SPA mode by adding a header to the request. If the application uses SSR and is forced to switch to SPA, this causes an error that completely corrupts the page. If a cache system is in place, this allows the response containing the error to be cached, resulting in a cache poisoning that strongly impacts the availability of the application.\n\n## Details\nThe vulnerable header is `X-React-Router-SPA-Mode`; adding it to a request sent to a page/endpoint using a loader throws an error. Here is [the vulnerable code](https://github.com/remix-run/react-router/blob/e6c53a0130559b4a9bd47f9cf76ea5b08a69868a/packages/react-router/lib/server-runtime/server.ts#L407) :\n\n\u003cimg width=\"672\" alt=\"Capture d’écran 2025-04-07 à 08 28 20\" src=\"https://github.com/user-attachments/assets/0a0e9c41-70fd-4dba-9061-892dd6797291\" /\u003e\n\nTo use the header, React-router must be used in Framework mode, and for the attack to be possible the target page must use a loader.\n\n## Steps to reproduce \nVersions used for our PoC: \n- \"@react-router/node\": \"^7.5.0\",\n- \"@react-router/serve\": \"^7.5.0\",\n- \"react\": \"^19.0.0\"\n- \"react-dom\": \"^19.0.0\"\n- \"react-router\": \"^7.5.0\"\n\n1. Install React-Router with its default configuration in Framework mode (https://reactrouter.com/start/framework/installation)\n2. Add a simple page using a loader (example: `routes/ssr`)\n\n![image](https://github.com/user-attachments/assets/d7d04e86-c549-4f4a-9200-2d1b6ac96aad)\n\n3. Send a request to the endpoint using the loader (`/ssr` in our case) adding the following header:\n```\nX-React-Router-SPA-Mode: yes\n```\n\nNotice the difference between a request with and without the header;\n\n**Normal request**\n![Capture d’écran 2025-04-07 à 08 36 27](https://github.com/user-attachments/assets/da372b70-7c68-41c1-aac1-e5be94f22526)\n\n**With the header**\n![Capture d’écran 2025-04-07 à 08 37 01](https://github.com/user-attachments/assets/98101720-cb5b-44e9-bff5-463c0b4dab2a)\n![image](https://github.com/user-attachments/assets/c16a101e-688c-4757-9e05-61308ed8a2de)\n\n## Impact\nIf a system cache is in place, it is possible to poison the response by completely altering its content (*by an error message*), strongly impacting its availability, making the latter impractical via a cache-poisoning attack.\n\n## Credits\n- Rachid Allam (zhero;)\n- Yasser Allam (inzo_)","status":"published","published":"2025-04-24T16:31:16Z","modified":"2025-04-25T14:32:58Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-755"],"updated_at":"2026-11-02T14:38:41.402125Z"}],"nvd":[{"id":"CVE-2025-43864","description":"React Router is a router for React. Starting in version 7.2.0 and prior to version 7.5.2, it is possible to force an application to switch to SPA mode by adding a header to the request. If the application uses SSR and is forced to switch to SPA, this causes an error that completely corrupts the page. If a cache system is in place, this allows the response containing the error to be cached, resulting in a cache poisoning that strongly impacts the availability of the application. This issue has been patched in version 7.5.2.","status":"published","published":"2025-04-25T01:15:43.117Z","modified":"2026-06-17T09:24:40.123Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-755"],"updated_at":"2026-11-02T14:11:02.570368Z"}],"osv":[{"id":"CVE-2025-43864","title":"React Router allows a DoS via cache poisoning by forcing SPA mode","description":"React Router is a router for React. Starting in version 7.2.0 and prior to version 7.5.2, it is possible to force an application to switch to SPA mode by adding a header to the request. If the application uses SSR and is forced to switch to SPA, this causes an error that completely corrupts the page. If a cache system is in place, this allows the response containing the error to be cached, resulting in a cache poisoning that strongly impacts the availability of the application. This issue has been patched in version 7.5.2.","status":"published","published":"2025-04-25T00:18:16.058Z","modified":"2026-10-28T02:31:09.802421427Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-755"],"updated_at":"2026-11-02T15:44:49.707645Z"},{"id":"GHSA-f46r-rw29-r322","title":"React Router allows a DoS via cache poisoning by forcing SPA mode","description":"## Summary\nAfter some research, it turns out that it is possible to force an application to switch to SPA mode by adding a header to the request. If the application uses SSR and is forced to switch to SPA, this causes an error that completely corrupts the page. If a cache system is in place, this allows the response containing the error to be cached, resulting in a cache poisoning that strongly impacts the availability of the application.\n\n## Details\nThe vulnerable header is `X-React-Router-SPA-Mode`; adding it to a request sent to a page/endpoint using a loader throws an error. Here is [the vulnerable code](https://github.com/remix-run/react-router/blob/e6c53a0130559b4a9bd47f9cf76ea5b08a69868a/packages/react-router/lib/server-runtime/server.ts#L407) :\n\n\u003cimg width=\"672\" alt=\"Capture d’écran 2025-04-07 à 08 28 20\" src=\"https://github.com/user-attachments/assets/0a0e9c41-70fd-4dba-9061-892dd6797291\" /\u003e\n\nTo use the header, React-router must be used in Framework mode, and for the attack to be possible the target page must use a loader.\n\n## Steps to reproduce \nVersions used for our PoC: \n- \"@react-router/node\": \"^7.5.0\",\n- \"@react-router/serve\": \"^7.5.0\",\n- \"react\": \"^19.0.0\"\n- \"react-dom\": \"^19.0.0\"\n- \"react-router\": \"^7.5.0\"\n\n1. Install React-Router with its default configuration in Framework mode (https://reactrouter.com/start/framework/installation)\n2. Add a simple page using a loader (example: `routes/ssr`)\n\n![image](https://github.com/user-attachments/assets/d7d04e86-c549-4f4a-9200-2d1b6ac96aad)\n\n3. Send a request to the endpoint using the loader (`/ssr` in our case) adding the following header:\n```\nX-React-Router-SPA-Mode: yes\n```\n\nNotice the difference between a request with and without the header;\n\n**Normal request**\n![Capture d’écran 2025-04-07 à 08 36 27](https://github.com/user-attachments/assets/da372b70-7c68-41c1-aac1-e5be94f22526)\n\n**With the header**\n![Capture d’écran 2025-04-07 à 08 37 01](https://github.com/user-attachments/assets/98101720-cb5b-44e9-bff5-463c0b4dab2a)\n![image](https://github.com/user-attachments/assets/c16a101e-688c-4757-9e05-61308ed8a2de)\n\n## Impact\nIf a system cache is in place, it is possible to poison the response by completely altering its content (*by an error message*), strongly impacting its availability, making the latter impractical via a cache-poisoning attack.\n\n## Credits\n- Rachid Allam (zhero;)\n- Yasser Allam (inzo_)","status":"published","published":"2025-04-24T16:31:16Z","modified":"2025-04-25T14:32:54Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-755"],"updated_at":"2026-11-02T15:46:46.006631Z"},{"id":"CLSA-2026-1775521859","title":"TuxCare security update for react-router (2 CVEs)","description":"TuxCare rebuilt react-router to address 2 CVEs. Fixed in 7.5.1-tuxcare.1.","status":"published","published":"2026-08-04T14:52:22Z","modified":"2026-10-30T19:45:52.746207851Z","updated_at":"2026-11-02T15:43:44.009773Z"},{"id":"CLSA-2026-1792253396","title":"TuxCare security update for react-router-dom (2 CVEs)","description":"TuxCare rebuilt react-router-dom to address 2 CVEs. Fixed in 7.5.1-tuxcare.1.","status":"published","published":"2026-10-17T16:09:55Z","modified":"2026-10-17T19:01:40.657484185Z","updated_at":"2026-11-02T15:43:52.011757Z"},{"id":"CLSA-2026-1792419110","title":"TuxCare security update for @react-router/architect (2 CVEs)","description":"TuxCare rebuilt @react-router/architect to address 2 CVEs. Fixed in 7.5.1-tuxcare.1.","status":"published","published":"2026-10-19T14:11:50Z","modified":"2026-10-19T19:15:13.330470334Z","updated_at":"2026-11-02T15:43:54.119956Z"},{"id":"CLSA-2026-1792419187","title":"TuxCare security update for @react-router/cloudflare (2 CVEs)","description":"TuxCare rebuilt @react-router/cloudflare to address 2 CVEs. Fixed in 7.5.1-tuxcare.1.","status":"published","published":"2026-10-19T14:13:07Z","modified":"2026-10-19T19:15:13.434609618Z","updated_at":"2026-11-02T15:43:54.119956Z"},{"id":"CLSA-2026-1792419266","title":"TuxCare security update for @react-router/express (2 CVEs)","description":"TuxCare rebuilt @react-router/express to address 2 CVEs. Fixed in 7.5.1-tuxcare.1.","status":"published","published":"2026-10-19T14:14:26Z","modified":"2026-10-19T19:15:17.441117526Z","updated_at":"2026-11-02T15:43:54.119956Z"},{"id":"CLSA-2026-1792419622","title":"TuxCare security update for @react-router/node (2 CVEs)","description":"TuxCare rebuilt @react-router/node to address 2 CVEs. Fixed in 7.5.1-tuxcare.1.","status":"published","published":"2026-10-19T14:20:22Z","modified":"2026-10-19T19:15:15.336079713Z","updated_at":"2026-11-02T15:43:54.119956Z"},{"id":"CLSA-2026-1792421940","title":"TuxCare security update for @react-router/remix-routes-option-adapter (2 CVEs)","description":"TuxCare rebuilt @react-router/remix-routes-option-adapter to address 2 CVEs. Fixed in 7.5.1-tuxcare.1.","status":"published","published":"2026-10-19T14:59:00Z","modified":"2026-10-19T19:15:17.348600982Z","updated_at":"2026-11-02T15:43:54.119956Z"},{"id":"CLSA-2026-1792424729","title":"TuxCare security update for @react-router/dev (2 CVEs)","description":"TuxCare rebuilt @react-router/dev to address 2 CVEs. Fixed in 7.5.1-tuxcare.1.","status":"published","published":"2026-10-19T15:45:29Z","modified":"2026-10-19T19:15:20.297675295Z","updated_at":"2026-11-02T15:43:54.119956Z"},{"id":"CLSA-2026-1792425404","title":"TuxCare security update for @react-router/fs-routes (2 CVEs)","description":"TuxCare rebuilt @react-router/fs-routes to address 2 CVEs. Fixed in 7.5.1-tuxcare.1.","status":"published","published":"2026-10-19T15:56:44Z","modified":"2026-10-19T19:15:19.752044444Z","updated_at":"2026-11-02T15:43:54.119956Z"},{"id":"CLSA-2026-1792428105","title":"TuxCare security update for @react-router/serve (2 CVEs)","description":"TuxCare rebuilt @react-router/serve to address 2 CVEs. Fixed in 7.5.1-tuxcare.1.","status":"published","published":"2026-10-19T16:41:45Z","modified":"2026-10-19T19:15:22.139647085Z","updated_at":"2026-11-02T15:43:54.119956Z"},{"id":"CLSA-2026-1792430029","title":"TuxCare security update for create-react-router (2 CVEs)","description":"TuxCare rebuilt create-react-router to address 2 CVEs. Fixed in 7.5.1-tuxcare.1.","status":"published","published":"2026-10-19T17:13:49Z","modified":"2026-10-19T19:15:23.939841069Z","updated_at":"2026-11-02T15:43:54.119956Z"}]}}