CVE-2025-43865 affects React Router versions on the 7.0 branch prior to 7.5.2, allowing an attacker to manipulate pre-rendered data by injecting a malicious header into a request. This vulnerability carries a CVSS score of 8.2 (High), indicating a low attack complexity and no required user interaction, with potential for high impact on data integrity. While no active exploitation, public exploits, or significant community discussion have been observed, the ease of exploitation and potential for data spoofing warrant attention.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
| Remix-Run | React-Router | >= 7.0, < 7.5.2CNA affected |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.1 Mastodon, and 0.4 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.