{"id":"CVE-2025-43865","aliases":["CLSA-2026-1775521859","CLSA-2026-1792253396","CLSA-2026-1792419110","CLSA-2026-1792419187","CLSA-2026-1792419266","CLSA-2026-1792419622","CLSA-2026-1792421940","CLSA-2026-1792424729","CLSA-2026-1792425404","CLSA-2026-1792428105","CLSA-2026-1792430029","EUVD-2025-11979","GHSA-cpj6-fhp6-mr6j"],"status":"published","title":"React Router allows pre-render data spoofing on React-Router framework mode","description":"React Router is a router for React. In versions on the 7.0 branch prior to version 7.5.2, it's possible to modify pre-rendered data by adding a header to the request. This allows to completely spoof its contents and modify all the values ​​of the data object passed to the HTML. This issue has been patched in version 7.5.2.","severity":{"version":"3.1","score":8.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00815,"percentile":0.57321,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":true},"cwes":["CWE-345"],"published":"2025-04-24T16:31:32Z","modified":"2026-10-30T19:45:52Z","exploits":[{"source":"pocgithub","id":"pouriam23/Pre-render-data-spoofing-on-React-Router-framework-mode-CVE-2025-43865","title":"pouriam23/Pre-render-data-spoofing-on-React-Router-framework-mode-CVE-2025-43865","date":"2025-04-27","url":"https://github.com/pouriam23/Pre-render-data-spoofing-on-React-Router-framework-mode-CVE-2025-43865"}],"fixes":[{"ecosystem":"npm","package":"react-router","fixed_in":["7.5.2"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"react-router","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.0.0-pre.0"},{"last_affected":"7.5.1"},{"fixed":"7.5.2"}]}]},{"source":"osv","ecosystem":"TuxCare:npm","package":"react-router","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.5.1-tuxcare.0"},{"fixed":"7.5.1-tuxcare.1"}]}],"versions":["7.5.1"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:npm","package":"react-router-dom","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.5.1-tuxcare.0"},{"fixed":"7.5.1-tuxcare.1"}]}],"versions":["7.5.1"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:npm","package":"@react-router/architect","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.5.1-tuxcare.0"},{"fixed":"7.5.1-tuxcare.1"}]}],"versions":["7.5.1"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:npm","package":"@react-router/cloudflare","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.5.1-tuxcare.0"},{"fixed":"7.5.1-tuxcare.1"}]}],"versions":["7.5.1"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:npm","package":"@react-router/express","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.5.1-tuxcare.0"},{"fixed":"7.5.1-tuxcare.1"}]}],"versions":["7.5.1"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:npm","package":"@react-router/node","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.5.1-tuxcare.0"},{"fixed":"7.5.1-tuxcare.1"}]}],"versions":["7.5.1"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:npm","package":"@react-router/remix-routes-option-adapter","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.5.1-tuxcare.0"},{"fixed":"7.5.1-tuxcare.1"}]}],"versions":["7.5.1"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:npm","package":"@react-router/dev","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.5.1-tuxcare.0"},{"fixed":"7.5.1-tuxcare.1"}]}],"versions":["7.5.1"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:npm","package":"@react-router/fs-routes","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.5.1-tuxcare.0"},{"fixed":"7.5.1-tuxcare.1"}]}],"versions":["7.5.1"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:npm","package":"@react-router/serve","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.5.1-tuxcare.0"},{"fixed":"7.5.1-tuxcare.1"}]}],"versions":["7.5.1"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:npm","package":"create-react-router","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.5.1-tuxcare.0"},{"fixed":"7.5.1-tuxcare.1"}]}],"versions":["7.5.1"],"bundled":2},{"source":"osv","ecosystem":"npm","package":"react-router","ranges":[{"type":"SEMVER","events":[{"introduced":"7.0.0-pre.0"},{"fixed":"7.5.2"}]}]}],"products":[{"vendor":"@tanstack","product":"react-router"},{"vendor":"remix-run","product":"react-router"}],"references":[{"url":"https://github.com/remix-run/react-router/security/advisories/GHSA-cpj6-fhp6-mr6j","tags":["x_refsource_CONFIRM","advisory","web"]},{"url":"https://github.com/remix-run/react-router/commit/c84302972a152d851cf5dd859ff332b354b70111","tags":["x_refsource_MISC","fix","web"]},{"url":"https://github.com/remix-run/react-router/blob/e6c53a0130559b4a9bd47f9cf76ea5b08a69868a/packages/react-router/lib/server-runtime/routes.ts#L87","tags":["x_refsource_MISC","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-43865","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-cpj6-fhp6-mr6j"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/43xxx/CVE-2025-43865.json","tags":["advisory"]},{"url":"https://github.com/remix-run/react-router","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2025-43865","title":"React Router allows pre-render data spoofing on React-Router framework mode","description":"React Router is a router for React. In versions on the 7.0 branch prior to version 7.5.2, it's possible to modify pre-rendered data by adding a header to the request. This allows to completely spoof its contents and modify all the values ​​of the data object passed to the HTML. This issue has been patched in version 7.5.2.","status":"published","published":"2025-04-25T00:18:53.222Z","modified":"2025-04-25T15:16:00.202Z","cvss":[{"version":"3.1","score":8.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-345"],"updated_at":"2026-11-02T14:32:26.964524Z"}],"euvd":[{"id":"EUVD-2025-11979","description":"React Router is a router for React. In versions on the 7.0 branch prior to version 7.5.2, it's possible to modify pre-rendered data by adding a header to the request. This allows to completely spoof its contents and modify all the values ​​of the data object passed to the HTML. This issue has been patched in version 7.5.2.","status":"published","published":"2025-04-25T00:18:53Z","modified":"2025-04-25T15:16:00Z","cvss":[{"version":"3.1","score":8.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H","level":"high"}],"updated_at":"2026-11-02T20:52:02.967137Z"}],"ghsa":[{"id":"GHSA-cpj6-fhp6-mr6j","title":"React Router allows pre-render data spoofing on React-Router framework mode","description":"## Summary\nAfter some research, it turns out that it's possible to modify pre-rendered data by adding a header to the request. This allows to completely spoof its contents and modify all the values ​​of the data object passed to the HTML. Latest versions are impacted.\n\n## Details\nThe vulnerable header is `X-React-Router-Prerender-Data`, a specific JSON object must be passed to it in order for the spoofing to be successful as we will see shortly. Here is [the vulnerable code](https://github.com/remix-run/react-router/blob/e6c53a0130559b4a9bd47f9cf76ea5b08a69868a/packages/react-router/lib/server-runtime/routes.ts#L87) :\n\n\u003cimg width=\"776\" alt=\"Capture d’écran 2025-04-07 à 05 36 58\" src=\"https://github.com/user-attachments/assets/c95b0b33-15ce-4d30-9f5e-b10525dd6ab4\" /\u003e\n\nTo use the header, React-router must be used in Framework mode, and for the attack to be possible the target page must use a loader.\n\n## Steps to reproduce \nVersions used for our PoC: \n- \"@react-router/node\": \"^7.5.0\",\n- \"@react-router/serve\": \"^7.5.0\",\n- \"react\": \"^19.0.0\"\n- \"react-dom\": \"^19.0.0\"\n- \"react-router\": \"^7.5.0\"\n\n1. Install React-Router with its default configuration in Framework mode (https://reactrouter.com/start/framework/installation)\n2. Add a simple page using a loader (example: `routes/ssr`)\n3. Access your page (*which uses the loader*) by suffixing it with `.data`. In our case the page is called `/ssr`:\n\n![image](https://github.com/user-attachments/assets/d7d04e86-c549-4f4a-9200-2d1b6ac96aad)\n\nWe access it by adding the suffix `.data` and retrieve the data object, needed for the header:\n\n![image](https://github.com/user-attachments/assets/ea0ca23e-6ba5-49c1-980d-1b04a05acf56)\n\n4. Send your request by adding the `X-React-Router-Prerender-Data` header with the previously retrieved object as its value. You can change any value of your `data` object (do not touch the other values, the latter being necessary for the object to be processed correctly and not throw an error):\n\n![Capture d’écran 2025-04-07 à 05 56 10](https://github.com/user-attachments/assets/42ca7c9e-5cd3-4eff-9711-1e78755c9046)\n\nAs you can see, all values ​​have been changed/overwritten by the values ​​provided via the header. \n\n## Impact\nThe impact is significant, if a cache system is in place, it is possible to poison a response in which all of the data transmitted via a loader would be altered by an attacker allowing him to take control of the content of the page and modify it as he wishes via a cache-poisoning attack. This can lead to several types of attacks including potential stored XSS depending on the context in which the data is injected and/or how the data is used on the client-side.\n\n## Credits\n- Rachid Allam (zhero;)\n- Yasser Allam (inzo_)","status":"published","published":"2025-04-24T16:31:32Z","modified":"2026-01-16T22:01:21Z","cvss":[{"version":"3.1","score":8.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H","level":"high"}],"cwes":["CWE-345"],"updated_at":"2026-11-02T14:39:18.564331Z"}],"nvd":[{"id":"CVE-2025-43865","description":"React Router is a router for React. In versions on the 7.0 branch prior to version 7.5.2, it's possible to modify pre-rendered data by adding a header to the request. This allows to completely spoof its contents and modify all the values ​​of the data object passed to the HTML. This issue has been patched in version 7.5.2.","status":"published","published":"2025-04-25T01:15:43.27Z","modified":"2026-06-17T09:24:40.22Z","cvss":[{"version":"3.1","score":8.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-345"],"updated_at":"2026-11-02T14:11:02.570368Z"}],"osv":[{"id":"CVE-2025-43865","title":"React Router allows pre-render data spoofing on React-Router framework mode","description":"React Router is a router for React. In versions on the 7.0 branch prior to version 7.5.2, it's possible to modify pre-rendered data by adding a header to the request. This allows to completely spoof its contents and modify all the values ​​of the data object passed to the HTML. This issue has been patched in version 7.5.2.","status":"published","published":"2025-04-25T00:18:53.222Z","modified":"2026-10-28T02:31:09.027633828Z","cvss":[{"version":"3.1","score":8.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H","level":"high"}],"cwes":["CWE-345"],"updated_at":"2026-11-02T15:44:49.707645Z"},{"id":"GHSA-cpj6-fhp6-mr6j","title":"React Router allows pre-render data spoofing on React-Router framework mode","description":"## Summary\nAfter some research, it turns out that it's possible to modify pre-rendered data by adding a header to the request. This allows to completely spoof its contents and modify all the values ​​of the data object passed to the HTML. Latest versions are impacted.\n\n## Details\nThe vulnerable header is `X-React-Router-Prerender-Data`, a specific JSON object must be passed to it in order for the spoofing to be successful as we will see shortly. Here is [the vulnerable code](https://github.com/remix-run/react-router/blob/e6c53a0130559b4a9bd47f9cf76ea5b08a69868a/packages/react-router/lib/server-runtime/routes.ts#L87) :\n\n\u003cimg width=\"776\" alt=\"Capture d’écran 2025-04-07 à 05 36 58\" src=\"https://github.com/user-attachments/assets/c95b0b33-15ce-4d30-9f5e-b10525dd6ab4\" /\u003e\n\nTo use the header, React-router must be used in Framework mode, and for the attack to be possible the target page must use a loader.\n\n## Steps to reproduce \nVersions used for our PoC: \n- \"@react-router/node\": \"^7.5.0\",\n- \"@react-router/serve\": \"^7.5.0\",\n- \"react\": \"^19.0.0\"\n- \"react-dom\": \"^19.0.0\"\n- \"react-router\": \"^7.5.0\"\n\n1. Install React-Router with its default configuration in Framework mode (https://reactrouter.com/start/framework/installation)\n2. Add a simple page using a loader (example: `routes/ssr`)\n3. Access your page (*which uses the loader*) by suffixing it with `.data`. In our case the page is called `/ssr`:\n\n![image](https://github.com/user-attachments/assets/d7d04e86-c549-4f4a-9200-2d1b6ac96aad)\n\nWe access it by adding the suffix `.data` and retrieve the data object, needed for the header:\n\n![image](https://github.com/user-attachments/assets/ea0ca23e-6ba5-49c1-980d-1b04a05acf56)\n\n4. Send your request by adding the `X-React-Router-Prerender-Data` header with the previously retrieved object as its value. You can change any value of your `data` object (do not touch the other values, the latter being necessary for the object to be processed correctly and not throw an error):\n\n![Capture d’écran 2025-04-07 à 05 56 10](https://github.com/user-attachments/assets/42ca7c9e-5cd3-4eff-9711-1e78755c9046)\n\nAs you can see, all values ​​have been changed/overwritten by the values ​​provided via the header. \n\n## Impact\nThe impact is significant, if a cache system is in place, it is possible to poison a response in which all of the data transmitted via a loader would be altered by an attacker allowing him to take control of the content of the page and modify it as he wishes via a cache-poisoning attack. This can lead to several types of attacks including potential stored XSS depending on the context in which the data is injected and/or how the data is used on the client-side.\n\n## Credits\n- Rachid Allam (zhero;)\n- Yasser Allam (inzo_)","status":"published","published":"2025-04-24T16:31:32Z","modified":"2026-02-03T03:07:14.588572Z","cvss":[{"version":"3.1","score":8.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H","level":"high"}],"cwes":["CWE-345"],"updated_at":"2026-11-02T15:46:45.28161Z"},{"id":"CLSA-2026-1775521859","title":"TuxCare security update for react-router (2 CVEs)","description":"TuxCare rebuilt react-router to address 2 CVEs. Fixed in 7.5.1-tuxcare.1.","status":"published","published":"2026-08-04T14:52:22Z","modified":"2026-10-30T19:45:52.746207851Z","updated_at":"2026-11-02T15:43:44.009773Z"},{"id":"CLSA-2026-1792253396","title":"TuxCare security update for react-router-dom (2 CVEs)","description":"TuxCare rebuilt react-router-dom to address 2 CVEs. Fixed in 7.5.1-tuxcare.1.","status":"published","published":"2026-10-17T16:09:55Z","modified":"2026-10-17T19:01:40.657484185Z","updated_at":"2026-11-02T15:43:52.011757Z"},{"id":"CLSA-2026-1792419110","title":"TuxCare security update for @react-router/architect (2 CVEs)","description":"TuxCare rebuilt @react-router/architect to address 2 CVEs. Fixed in 7.5.1-tuxcare.1.","status":"published","published":"2026-10-19T14:11:50Z","modified":"2026-10-19T19:15:13.330470334Z","updated_at":"2026-11-02T15:43:54.119956Z"},{"id":"CLSA-2026-1792419187","title":"TuxCare security update for @react-router/cloudflare (2 CVEs)","description":"TuxCare rebuilt @react-router/cloudflare to address 2 CVEs. Fixed in 7.5.1-tuxcare.1.","status":"published","published":"2026-10-19T14:13:07Z","modified":"2026-10-19T19:15:13.434609618Z","updated_at":"2026-11-02T15:43:54.119956Z"},{"id":"CLSA-2026-1792419266","title":"TuxCare security update for @react-router/express (2 CVEs)","description":"TuxCare rebuilt @react-router/express to address 2 CVEs. Fixed in 7.5.1-tuxcare.1.","status":"published","published":"2026-10-19T14:14:26Z","modified":"2026-10-19T19:15:17.441117526Z","updated_at":"2026-11-02T15:43:54.119956Z"},{"id":"CLSA-2026-1792419622","title":"TuxCare security update for @react-router/node (2 CVEs)","description":"TuxCare rebuilt @react-router/node to address 2 CVEs. Fixed in 7.5.1-tuxcare.1.","status":"published","published":"2026-10-19T14:20:22Z","modified":"2026-10-19T19:15:15.336079713Z","updated_at":"2026-11-02T15:43:54.119956Z"},{"id":"CLSA-2026-1792421940","title":"TuxCare security update for @react-router/remix-routes-option-adapter (2 CVEs)","description":"TuxCare rebuilt @react-router/remix-routes-option-adapter to address 2 CVEs. Fixed in 7.5.1-tuxcare.1.","status":"published","published":"2026-10-19T14:59:00Z","modified":"2026-10-19T19:15:17.348600982Z","updated_at":"2026-11-02T15:43:54.119956Z"},{"id":"CLSA-2026-1792424729","title":"TuxCare security update for @react-router/dev (2 CVEs)","description":"TuxCare rebuilt @react-router/dev to address 2 CVEs. Fixed in 7.5.1-tuxcare.1.","status":"published","published":"2026-10-19T15:45:29Z","modified":"2026-10-19T19:15:20.297675295Z","updated_at":"2026-11-02T15:43:54.119956Z"},{"id":"CLSA-2026-1792425404","title":"TuxCare security update for @react-router/fs-routes (2 CVEs)","description":"TuxCare rebuilt @react-router/fs-routes to address 2 CVEs. Fixed in 7.5.1-tuxcare.1.","status":"published","published":"2026-10-19T15:56:44Z","modified":"2026-10-19T19:15:19.752044444Z","updated_at":"2026-11-02T15:43:54.119956Z"},{"id":"CLSA-2026-1792428105","title":"TuxCare security update for @react-router/serve (2 CVEs)","description":"TuxCare rebuilt @react-router/serve to address 2 CVEs. Fixed in 7.5.1-tuxcare.1.","status":"published","published":"2026-10-19T16:41:45Z","modified":"2026-10-19T19:15:22.139647085Z","updated_at":"2026-11-02T15:43:54.119956Z"},{"id":"CLSA-2026-1792430029","title":"TuxCare security update for create-react-router (2 CVEs)","description":"TuxCare rebuilt create-react-router to address 2 CVEs. Fixed in 7.5.1-tuxcare.1.","status":"published","published":"2026-10-19T17:13:49Z","modified":"2026-10-19T19:15:23.939841069Z","updated_at":"2026-11-02T15:43:54.119956Z"}]}}