CVE-2025-43864 - CVE House
Back to Database
Status published High CVE-2025-43864

React Router allows a DoS via cache poisoning by forcing SPA mode

Vulnerability Description

React Router is a router for React. Starting in version 7.2.0 and prior to version 7.5.2, it is possible to force an application to switch to SPA mode by adding a header to the request. If the application uses SSR and is forced to switch to SPA, this causes an error that completely corrupts the page. If a cache system is in place, this allows the response containing the error to be cached, resulting in a cache poisoning that strongly impacts the availability of the application. This issue has been patched in version 7.5.2.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-43864

Credits & Attribution

No credits recorded in the NVD database.

References

More from remix-run

View All →
CVE-2025-68470
React Router has unexpected external redirect via untrusted paths
Medium 6.5
CVE-2025-61686
React Router has Path Traversal in File Session Storage
Critical 9.1
CVE-2025-59057
React Router has XSS Vulnerability
High 7.6
CVE-2025-43865
React Router allows pre-render data spoofing on React-Router framework mode
High 8.2
CVE-2025-31137
Remix and React Router allow URL manipulation via Host / X-Forwarded-Host headers
High 7.5

Affected Vendor

Affected Software

react-router
Vulnerable Versions:
>= 7.2.0, < 7.5.2

Timeline

Official Publish: April 25th, 2025
Last Modified: April 25th, 2025
Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weaknesses (CWE)

CWE-755

MITRE ATT&CK TTPs

T1190 Exploit Public-Facing Application
Initial Access
T1203 Exploitation for Client Execution
Execution
T1213 Data from Information Repositories
Collection
T1499 Endpoint Denial of Service
Impact