CVE-2025-43865: Critical Spoofing Vulnerability in React Router Prior to Version 7.5.2

Overview

React Router, a widely used router for the popular JavaScript library, React, has a critical vulnerability in versions on the 7.0 branch prior to version 7.5.2. This vulnerability, identified as CVE-2025-43865, allows potential bad actors to modify pre-rendered data, enabling them to spoof the contents entirely and manipulate the values of the data object passed to the HTML. This exposes systems and applications to potential compromise and data leakage, impacting any organization or individual utilizing affected versions of React Router.
Vulnerabilities like this matter because they can lead to unauthorized access, manipulation, and potential theft of sensitive data. Given the widespread use of React and the React Router plugin, this vulnerability could have far-reaching implications if left unpatched.

Vulnerability Summary

CVE ID: CVE-2025-43865
Severity: High (CVSS: 8.2)
Attack Vector: Network
Privileges Required: None
User Interaction: None
Impact: System compromise and potential data leakage

Affected Products

Product | Affected Versions

React Router | 7.0.0 – 7.5.1

How the Exploit Works

The vulnerability resides in the way React Router handles pre-rendered data. By adding a specific header to the request, an attacker can modify pre-rendered data and completely spoof its contents. This allows the attacker to modify all the values ​​of the data object passed to the HTML, potentially changing what is rendered in the user’s browser or even injecting malicious scripts.

Conceptual Example Code

Below is a simplified conceptual example of how this vulnerability might be exploited using a malicious HTTP request:

POST /vulnerable/endpoint HTTP/1.1
Host: target.example.com
Content-Type: application/json
Spoof-Header: 'True'
{ "malicious_payload": "<script>alert('This could be a malicious script')</script>" }

In this example, the ‘Spoof-Header’ added to the request could trigger the vulnerability, and the ‘malicious_payload’ could be any script or code the attacker wishes to run on the user’s browser.

Mitigation

React Router has released a patch in version 7.5.2 that fixes this vulnerability. All users are strongly advised to update to this version or later as soon as possible. If immediate patching is not possible, using a Web Application Firewall (WAF) or Intrusion Detection System (IDS) can provide temporary mitigation. However, these are not long-term solutions and updating to a patched version is crucial for security.