CVE-2025-31137

highpriority · track · 10EPSS 0.012 · 68 %ileexploit · PoCEURUUS

grimoire priorityP1 · Urgent

Exploitable?

Public exploit

1 exploit · PoC

Likely / severe?

1.19% (68th) EPSS

CVSS 7.5 · high

Is it mine?

6 products

Check your exposure

Who says so?

4 sources

cnnvd · enisa_euvd · fstec_bdu · osv

EPSS · scored 2026-10-27

React Router is a multi-strategy router for React bridging the gap from React 18 to React 19. There is a vulnerability in Remix/React Router that affects all Remix 2 and React Router 7 consumers using the Express adapter. Basically, this vulnerability allows anyone to spoof the URL used in an incoming Request by putting a URL pathname in the port section of a URL that is part of a Host or X-Forwarded-Host header sent to a Remix/React Router request handler. This issue has been patched and released in Remix 2.16.3 and React Router 7.4.1.

cvss

Technical severity, 0–10. One row per scoring source.

7.5

010

base score 0–10 · higher = more severe · hover a vector to decode

v3.07.5highCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:Hsecondary · ENISA EU

v3.07.5highCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:Hsecondary · security-advisories@github.comexploitability 3.9 · impact 3.6

v3.07.5highCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:Hsecondary · OSV

v3.17.5highAV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:Hsecondary · FSTEC (BDU) RU

ssvc

A stakeholder decision — act, attend, or track — from exploitation and impact.

Trackcoordinatorcisa_ssvcUS

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-444USCWE-444USCWE-444US

exploits (1)

Public proof-of-concept and weaponised exploit code.

pouriam23/vulnerability-in-Remix-React-Router-CVE-2025-31137-pouriam23/vulnerability-in-Remix-React-Router-CVE-2025-31137-PoC · poc_in_github

affected products (6)

Products and version ranges known to be affected.

remix-run react-router2.11.1, → 2.16.3enisa_euvdEU
remix-run react-router7.0.0, → 7.4.1enisa_euvdEU
Сообщество свободного программного обеспечения React Router7.0.0 → 7.4.1fstec_bduRU
Сообщество свободного программного обеспечения Remix2.11.1 → 2.16.3fstec_bduRU
npm @react-router/express7.0.0 → 7.4.1osvUSpkg:npm/%40react-router/express
npm @remix-run/express2.11.1 → 2.16.3osvUSpkg:npm/%40remix-run/express

advisories (1)

Vendor and ecosystem advisories describing this.

GHSA-4q56-crqp-v477Remix and React Router allow URL manipulation via Host / X-Forwarded-Host headers2025-04-01ghsa · osvUS
### Impact We received a report about a vulnerability in Remix/React Router that affects all Remix 2 and React Router 7 consumers using the Express adapter. Basically, this vulnerability allows anyone to spoof the URL used in an incoming `Request` by putting a URL pathname in the port section of a URL that is part of a `Host` or `X-Forwarded-Host` header sent to a Remix/React Router request handler. ### Patches This issue has been patched and released in Remix 2.16.3 React Router 7.4.1. ### Credits - Rachid Allam (zhero;) - Yasser Allam (inzo_)

also known as (4)

Other names and identifiers for this entity.

sources

Which sources assert this record, and when.

cnnvd enisa_euvd fstec_bdu osv NVD CVE.org MITRE

published 2025-04-01modified 2026-06-17

references (4)

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan