https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 29 Sep 2026 10:30:42 +0000 https://vulnerability.circl.lu/vuln/cve-2025-43864 <p><strong>Affected:</strong> remix-run react-router</p> <p>React Router is a router for React. Starting in version 7.2.0 and prior to version 7.5.2, it is possible to force an application to switch to SPA mode by adding a header to the request. If the application uses SSR and is forced to switch to SPA, this causes an error that completely corrupts the page. If a cache system is in place, this allows the response containing the error to be cached, resulting in a cache poisoning that strongly impacts the availability of the application. This issue has been patched in version 7.5.2.</p> <p><strong>Affected:</strong> remix-run react-router</p> <p>React Router is a router for React. Starting in version 7.2.0 and prior to version 7.5.2, it is possible to force an application to switch to SPA mode by adding a header to the request. If the application uses SSR and is forced to switch to SPA, this causes an error that completely corrupts the page. If a cache system is in place, this allows the response containing the error to be cached, resulting in a cache poisoning that strongly impacts the availability of the application. This issue has been patched in version 7.5.2.</p> https://vulnerability.circl.lu/vuln/cve-2025-43864 https://vulnerability.circl.lu/vuln/ghsa-f46r-rw29-r322 <p><strong>Affected:</strong> npm: react-router</p> <p>## Summary After some research, it turns out that it is possible to force an application to switch to SPA mode by adding a header to the request. If the application uses SSR and is forced to switch to SPA, this causes an error that completely corrupts the page. If a cache system is in place, this allows the response containing the error to be cached, resulting in a cache poisoning that strongly impacts the availability of the application.</p> <p>## Details The vulnerable header is `X-React-Router-SPA-Mode`; adding it to a request sent to a page/endpoint using a loader throws an error. Here is [the vulnerable code](https://github.com/remix-run/react-router/blob/e6c53a0130559b4a9bd47f9cf76ea5b08a69868a/packages/react-router/lib/server-runtime/server.ts#L407) :</p> <p>&lt;img width=&#34;672&#34; alt=&#34;Capture d’écran 2025-04-07 à 08 28 20&#34; src=&#34;https://github.com/user-attachments/assets/0a0e9c41-70fd-4dba-9061-892dd6797291&#34; /&gt;</p> <p>To use the header, React-router must be used in Framework mode, and for the attack to be possible the target page must use a loader.</p> <p>## Steps to reproduce Versions used for our PoC: - &#34;@react-router/node&#34;: &#34;^7.5.0&#34;, - &#34;@react-router/serve&#34;: &#34;^7.5.0&#34;, - &#34;react&#34;: &#34;^19.0.0&#34; - &#34;react-dom&#34;: &#34;^19.0.0&#34; - &#34;react-router&#34;: &#34;^7.5.0&#34;</p> <p>1. Install React-Router with its default configuration in Framework mode (https://reactrouter.com/start/framework/installation) 2. Add a simple page using a loader (example: `routes/ssr`)</p> <p> :</p> <p>&lt;img width=&#34;672&#34; alt=&#34;Capture d’écran 2025-04-07 à 08 28 20&#34; src=&#34;https://github.com/user-attachments/assets/0a0e9c41-70fd-4dba-9061-892dd6797291&#34; /&gt;</p> <p>To use the header, React-router must be used in Framework mode, and for the attack to be possible the target page must use a loader.</p> <p>## Steps to reproduce Versions used for our PoC: - &#34;@react-router/node&#34;: &#34;^7.5.0&#34;, - &#34;@react-router/serve&#34;: &#34;^7.5.0&#34;, - &#34;react&#34;: &#34;^19.0.0&#34; - &#34;react-dom&#34;: &#34;^19.0.0&#34; - &#34;react-router&#34;: &#34;^7.5.0&#34;</p> <p>1. Install React-Router with its default configuration in Framework mode (https://reactrouter.com/start/framework/installation) 2. Add a simple page using a loader (example: `routes/ssr`)</p> <p>![image](https://github.com/user-attachments/assets/d7d04e86-c549…</p> https://vulnerability.circl.lu/vuln/ghsa-f46r-rw29-r322