CVE-2025-43865: Remix-Run React-Router

High severity, CVSS 8.2. EPSS: 0.8% chance of exploitation in the next 30 days.

React Router is a router for React. In versions on the 7.0 branch prior to version 7.5.2, it's possible to modify pre-rendered data by adding a header to the request. This allows to completely spoof its contents and modify all the values ​​of the data object passed to the HTML. This issue has been patched in version 7.5.2.

Affected products

• Remix-Run React-Router: from 7.0, before 7.5.2 (fixed in 7.5.2)

Published 2025-04-25. Last modified 2026-06-17.