Data Spoofing Vulnerability in React Router: Pre-render Data Manipulation
Summary
CVE-2025-43865: React Router allows pre-render data spoofing on React-Router framework mode. Affects react-router versions >= 7.0, < 7.5.2. Fixed in 7.5.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
React Router is a popular library for routing in React applications, enabling developers to create dynamic single-page applications with ease. It allows for server-side rendering and client-side navigation, enhancing user experience. However, recent findings have revealed a significant vulnerability in its Framework mode that allows attackers to spoof pre-rendered data, potentially compromising the integrity of the application.
Vulnerability Detail
The vulnerability arises from the ability to manipulate pre-rendered data by sending a specially crafted HTTP header, X-React-Router-Prerender-Data. This header can contain a JSON object that, if accepted by the server, allows an attacker to alter the data object passed to the HTML. This can lead to cache poisoning attacks, where the attacker modifies the content of the page, potentially leading to stored XSS vulnerabilities depending on how the data is utilized on the client side. The issue affects the latest versions of React Router, specifically those prior to 7.5.2.
How To Fix
Latest published version: 8.5.0 as of 23 Oct 2026
npm install react-router@8.5.0Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
7.5.2
This is the first release that contains the fix.
npm install react-router@7.5.2Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, consider disabling the use of the X-React-Router-Prerender-Data header in your application until you can update to the patched version. Additionally, review your server configurations to ensure that only trusted sources can send requests that utilize this header.
Conclusion
The vulnerability in React Router allows for pre-render data spoofing, posing significant risks to applications using this library. It is crucial to update to the latest version to protect against potential attacks. Utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for react-router →
FAQ
The CVSS score of this vulnerability is 8.2, indicating a high severity level.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. Visit Vulert Scanner to check your application without needing to sign up.
If exploited, this vulnerability could lead to cache poisoning, allowing attackers to alter the content of pages and potentially execute stored XSS attacks.
Yes, updating to React Router version 7.5.2 or later will mitigate this vulnerability.
As a temporary measure, you can disable the use of the X-React-Router-Prerender-Data header and review your server settings to restrict access to trusted sources.
References
Related vulnerabilities
Recent vulnerabilities recorded for react-router.
