remix-run/react-router · Security
Remix and React Router allow URL manipulation via Host / X-Forwarded-Host headers
- GHSA ID
- GHSA-4q56-crqp-v477
- CVE ID
- CVE-2025-31137
- Severity
- high
- Published
- Updated
- CVSS
- 7.5 · CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- CVSS v3
- 7.5 · CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Description
Impact
We received a report about a vulnerability in Remix/React Router that affects all Remix 2 and React Router 7 consumers using the Express adapter. Basically, this vulnerability allows anyone to spoof the URL used in an incoming Request by putting a URL pathname in the port section of a URL that is part of a Host or X-Forwarded-Host header sent to a Remix/React Router request handler.
Patches
This issue has been patched and released in Remix 2.16.3 React Router 7.4.1.
Credits
- Rachid Allam (zhero;)
- Yasser Allam (inzo_)
CWEs
- CWE-444 · Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')