CVE-2025-31137 - CVE House
Back to Database
Status published High CVE-2025-31137

Remix and React Router allow URL manipulation via Host / X-Forwarded-Host headers

Vulnerability Description

React Router is a multi-strategy router for React bridging the gap from React 18 to React 19. There is a vulnerability in Remix/React Router that affects all Remix 2 and React Router 7 consumers using the Express adapter. Basically, this vulnerability allows anyone to spoof the URL used in an incoming Request by putting a URL pathname in the port section of a URL that is part of a Host or X-Forwarded-Host header sent to a Remix/React Router request handler. This issue has been patched and released in Remix 2.16.3 and React Router 7.4.1.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-31137

Credits & Attribution

No credits recorded in the NVD database.

References

More from remix-run

View All →
CVE-2025-68470
React Router has unexpected external redirect via untrusted paths
Medium 6.5
CVE-2025-61686
React Router has Path Traversal in File Session Storage
Critical 9.1
CVE-2025-59057
React Router has XSS Vulnerability
High 7.6
CVE-2025-43865
React Router allows pre-render data spoofing on React-Router framework mode
High 8.2
CVE-2025-43864
React Router allows a DoS via cache poisoning by forcing SPA mode
High 7.5

Affected Vendor

Affected Software

react-router
Vulnerable Versions:
>= 7.0.0, < 7.4.1, >= 2.11.1, < 2.16.3

Timeline

Official Publish: April 1st, 2025
Last Modified: April 2nd, 2025
Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weaknesses (CWE)

CWE-444

MITRE ATT&CK TTPs

T1190 Exploit Public-Facing Application
Initial Access
T1565.002 Stored Data Manipulation
Impact
T1078 Valid Accounts
Defense Evasion