CVE-2025-43864 – react-router

Package

Manager: npm
Name: react-router
Vulnerable Version: >=7.2.0 <7.5.2

Severity

Level: High

CVSS v3.1: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CVSS v4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

EPSS: 0.00044 pctl0.12692

Details

React Router allows a DoS via cache poisoning by forcing SPA mode ## Summary After some research, it turns out that it is possible to force an application to switch to SPA mode by adding a header to the request. If the application uses SSR and is forced to switch to SPA, this causes an error that completely corrupts the page. If a cache system is in place, this allows the response containing the error to be cached, resulting in a cache poisoning that strongly impacts the availability of the application. ## Details The vulnerable header is `X-React-Router-SPA-Mode`; adding it to a request sent to a page/endpoint using a loader throws an error. Here is [the vulnerable code](https://github.com/remix-run/react-router/blob/e6c53a0130559b4a9bd47f9cf76ea5b08a69868a/packages/react-router/lib/server-runtime/server.ts#L407) : <img width="672" alt="Capture d’écran 2025-04-07 à 08 28 20" src="https://github.com/user-attachments/assets/0a0e9c41-70fd-4dba-9061-892dd6797291" /> To use the header, React-router must be used in Framework mode, and for the attack to be possible the target page must use a loader. ## Steps to reproduce Versions used for our PoC: - "@react-router/node": "^7.5.0", - "@react-router/serve": "^7.5.0", - "react": "^19.0.0" - "react-dom": "^19.0.0" - "react-router": "^7.5.0" 1. Install React-Router with its default configuration in Framework mode (https://reactrouter.com/start/framework/installation) 2. Add a simple page using a loader (example: `routes/ssr`)  3. Send a request to the endpoint using the loader (`/ssr` in our case) adding the following header: ``` X-React-Router-SPA-Mode: yes ``` Notice the difference between a request with and without the header; **Normal request**  **With the header**   ## Impact If a system cache is in place, it is possible to poison the response by completely altering its content (*by an error message*), strongly impacting its availability, making the latter impractical via a cache-poisoning attack. ## Credits - Rachid Allam (zhero;) - Yasser Allam (inzo_)

Metadata

Created: 2025-04-24T16:31:16Z
Modified: 2025-04-25T14:32:54Z
Source: https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/04/GHSA-f46r-rw29-r322/GHSA-f46r-rw29-r322.json
CWE IDs: ["CWE-755"]
Alternative ID: GHSA-f46r-rw29-r322
Finding: F096
Auto approve: 1