CVE-2025-43865 HIGH

CVE-2025-43865: React Router allows pre-render data spoofing on React-Router framework mode

Vendor Remix-Run
Product react-router
Weakness CWE-345
Published April 25, 2025
Last update April 25, 2025
View on NVD All CVEs

CVSS base score

8.2/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction None
Confidentiality None
Integrity Low

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H

What the vulnerability does

01Description

React Router is a router for React. In versions on the 7.0 branch prior to version 7.5.2, it's possible to modify pre-rendered data by adding a header to the request. This allows to completely spoof its contents and modify all the values ​​of the data object passed to the HTML. This issue has been patched in version 7.5.2.

Key dates

02Disclosure timeline

April 25, 2025 CVE published
April 25, 2025 Record updated

Related vulnerabilities

04Related CVE

CVE-2026-7611 TRENDnet TEW-821DAP Firmware Update cameo_dev.sh platform_do_upgrade_cameo_dev data authenticity CVE-2026-42575 apko doesn't verify downloaded apk packages against APKINDEX checksum (package substitution possible) CVE-2026-8608 Event Monster <= 2.1.0 - Unauthenticated Insufficient Verification of Data Authenticity to Payment Bypass via em_capture_payment AJAX Action CVE-2026-30920 OneUptime has broken access control in GitHub App installation flow that allows unauthorized project binding CVE-2023-25178 Controller design flaw - unsigned firmware