CVE-2025-31137
High
Description
React Router is a multi-strategy router for React bridging the gap from React 18 to React 19. There is a vulnerability in Remix/React Router that affects all Remix 2 and React Router 7 consumers using the Express adapter. Basically, this vulnerability allows anyone to spoof the URL used in an incoming Request by putting a URL pathname in the port section of a URL that is part of a Host or X-Forwarded-Host header sent to a Remix/React Router request handler. This issue has been patched and released in Remix 2.16.3 and React Router 7.4.1.
SeverityHigh
CVSS7.5
Exploit probability—
Product@react-router/express
PublishedApr 1, 2025
First seenApr 1, 2025
Weakness typeCWE-444CWE-444
How to fix
Update
- @react-router/express7.4.1 or later
- @remix-run/express2.16.3 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| @react-router/expressnpm | 7.0.0 ≤ v < 7.4.1 | 7.4.1 |
| @remix-run/expressnpm | 2.11.1 ≤ v < 2.16.3 | 2.16.3 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.