CVE-2025-43864 HIGH

CVE-2025-43864: React Router allows a DoS via cache poisoning by forcing SPA mode

Vendor Remix-Run
Product react-router
Weakness CWE-755
Published April 25, 2025
Last update April 25, 2025
View on NVD All CVEs

CVSS base score

7.5/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction None
Confidentiality None
Integrity None

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

What the vulnerability does

01Description

React Router is a router for React. Starting in version 7.2.0 and prior to version 7.5.2, it is possible to force an application to switch to SPA mode by adding a header to the request. If the application uses SSR and is forced to switch to SPA, this causes an error that completely corrupts the page. If a cache system is in place, this allows the response containing the error to be cached, resulting in a cache poisoning that strongly impacts the availability of the application. This issue has been patched in version 7.5.2.

Key dates

02Disclosure timeline

April 25, 2025 CVE published
April 25, 2025 Record updated

Related vulnerabilities

04Related CVE

CVE-2023-41332 Denial of service via Kubernetes annotations in specific Cilium configurations CVE-2020-7926 Specific query can cause a DoS against MongoDB Server CVE-2021-0299 Junos OS: Kernel crash (vmcore) upon receipt of a malformed IPv6 packet CVE-2025-30652 Junos OS and Junos OS Evolved: Executing a specific CLI command when asregex-optimized is configured causes an rpd crash CVE-2020-2020 Cortex XDR Agent: Exceptional condition denial-of-service (DoS)