CVE-2025-43864
React Router is a router for React. Starting in version 7.2.0 and prior to version 7.5.2, it is possible to force an application to switch to SPA mode by adding a header to the request. If the application uses SSR and is forced to switch to SPA, this causes an error that completely corrupts the page. If a cache system is in place, this allows the response containing the error to be cached, resulting in a cache poisoning that strongly impacts the availability of the application. This issue has been patched in version 7.5.2.
Scoring
- Severity
- HIGH
- CVSS base score
- 7.5
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- EPSS probability
- 20.21%
- CWE
- CWE-755
- Published
- 2025-04-25
- Last modified
- 2026-03-13
Affected products
- remix-run react-router
Weakness type
Related vulnerabilities
- CVE-2026-49305 — Permission control vulnerability in the Wi-Fi enhancement module. Impact: Successful exploitation...
- CVE-2026-45819 — baseline-browser-mapping 2.x before 2.11.0 calls process.exit() instead of throwing on invalid or...
- CVE-2026-52856 — Wings: Maliciously crafted packet during SFTP connection handshake causes denial of service
- CVE-2026-59952 — Valibot: record() issue paths can make flatten() throw for inherited Object property names
- CVE-2026-42792 — epmd permanent DoS via EMFILE on accept(2) in erts
- CVE-2026-48036 — Hulumi: Drift classifier fails open on adapter errors and over-promotes Mixed verdicts
- CVE-2026-16730 — Dbus-broker: dbus-broker: session bus denial of service via emfile during peer setup
- CVE-2026-62994 — CoreDNS `k8s_external` headless AXFR can emit an empty transfer batch that panics the `transfer` plugin