CVE-2025-43865CWE-345

React Router allows pre-render data spoofing on React-Router framework mode

High · published April 25, 2025

CVSS v3.1
8.2
EPSS
1%
Percentile
56.2
In the wild
Unconfirmed
What it is

React Router is a router for React. In versions on the 7.0 branch prior to version 7.5.2, it's possible to modify pre-rendered data by adding a header to the request. This allows to completely spoof its contents and modify all the values ​​of the data object passed to the HTML. This issue has been patched in version 7.5.2.

The record
Technical detail
CVSS v3.1
8.2 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H
CVSS v4.0
Not supplied
EPSS
0.00801 · 56.2th percentile
Weakness
CWE-345 · Insufficient Verification of Data Authenticity
Published
2025-04-25T00:18Z
EPSS history
Timeline
  • 25 APR 00:18Z
    React Router allows pre-render data spoofing on React-Router framework mode
    cvelistv5