CVE-2025-31137

HIGH

React-router Express < 7.4.1 - HTTP Request Smuggling

Title source: rule

Description

React Router is a multi-strategy router for React bridging the gap from React 18 to React 19. There is a vulnerability in Remix/React Router that affects all Remix 2 and React Router 7 consumers using the Express adapter. Basically, this vulnerability allows anyone to spoof the URL used in an incoming Request by putting a URL pathname in the port section of a URL that is part of a Host or X-Forwarded-Host header sent to a Remix/React Router request handler. This issue has been patched and released in Remix 2.16.3 and React Router 7.4.1.

Exploits (1)

nomisec WORKING POC 1 stars
by pouriam23 · poc
https://github.com/pouriam23/vulnerability-in-Remix-React-Router-CVE-2025-31137-

References (1)

Scores

CVSS v3 7.5
EPSS 0.0010
EPSS Percentile 27.5%
Attack Vector NETWORK
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Details

CWE
CWE-444
Status published
Products (4)
react-router/express 7.0.0 - 7.4.1npm
remix-run/express 2.11.1 - 2.16.3npm
remix-run/react-router >= 2.11.1, < 2.16.3
remix-run/react-router >= 7.0.0, < 7.4.1
Published Apr 01, 2025
Tracked Since Feb 18, 2026