CVE-2025-31137

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

React Router is a multi-strategy router for React bridging the gap from React 18 to React 19. There is a vulnerability in Remix/React Router that affects all Remix 2 and React Router 7 consumers using the Express adapter. Basically, this vulnerability allows anyone to spoof the URL used in an incoming Request by putting a URL pathname in the port section of a URL that is part of a Host or X-Forwarded-Host header sent to a Remix/React Router request handler. This issue has been patched and released in Remix 2.16.3 and React Router 7.4.1.

Metrics

CVSS 3.0 7.5/10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-444

Affected software

No affected versions have been published.

Timeline

Published: Apr 1, 2025
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2025

CVE-2025-311386.6tarteaucitron.js is a compliant and accessible cookie banner. A vulnerability was identified in tarteaucitron.js prior to 1.20.1, where user CVE-2025-311396.5In JetBrains TeamCity before 2025.03 base64 encoded password could be exposed in build log CVE-2025-31149.4Code Execution via Malicious Files: Attackers can create specially crafted files with embedded code that may execute without adequate securi CVE-2025-311406.1In JetBrains TeamCity before 2025.03 stored XSS was possible on Cloud Profiles page CVE-2025-311417.5In JetBrains TeamCity before 2025.03 exception could lead to credential leakage on Cloud Profiles page CVE-2025-311446.9Quick Agent V3 and Quick Agent V2 contain an issue with improper restriction of communication channel to intended endpoints. If exploited, a CVE-2025-311466.1Time-of-check time-of-use race condition for some Intel Ethernet Adapter Complete Driver Pack software before version 1.5.1.0 within Ring 3:CVE-2025-311475.3Unauthenticated attackers can query information about total energy consumed by EV chargers of arbitrary users.CVE-2025-31159.8Injection Vulnerabilities: Attackers can inject malicious code, potentially gaining control over the system executing these functions. Addit CVE-2025-31166.5CWE-20: Improper Input Validation vulnerability exists that could cause Denial of Service when an authenticated malicious user sends special CVE-2025-311602.9atop through 2.11.0 allows local users to cause a denial of service (e.g., assertion failure and application exit) or possibly have unspecif CVE-2025-311619.8CrushFTP 10 before 10.8.4 and 11 before 11.3.1 allows authentication bypass and takeover of the crushadmin account (unless a DMZ proxy insta