CVE-2025-43864

The record

React Router is a router for React. Starting in version 7.2.0 and prior to version 7.5.2, it is possible to force an application to switch to SPA mode by adding a header to the request. If the application uses SSR and is forced to switch to SPA, this causes an error that completely corrupts the page. If a cache system is in place, this allows the response containing the error to be cached, resulting in a cache poisoning that strongly impacts the availability of the application. This issue has been patched in version 7.5.2.

Affected packages

Related vulnerabilities

• CVE-2026-53663 React Router is a router for React. Also affects react-router
• GHSA-84g9-w2xq-vcv6 React Router: Potential CSRF via PUT/PATCH/DELETE document requests Also affects react-router
• GHSA-rxv8-25v2-qmq8 React Router vulnerable to Denial of Service via reflected user input in single-fetch Also affects react-router
• GHSA-8x6r-g9mw-2r78 React Router vulnerable to DoS via unbounded path expansion in __manifest endpoint Also affects react-router
• GHSA-49rj-9fvp-4h2h React Router's vendored turbo-stream v2 allows arbitrary constructor invocation via… Also affects react-router
• GHSA-2j2x-hqr9-3h42 React Router's same-origin redirect with path starting // causes open redirect via… Also affects react-router
• GHSA-8646-j5j9-6r62 React Router vulnerable to XSS in unstable RSC redirect handling via javascript: redirect… Also affects react-router
• GHSA-f22v-gfqf-p8f3 React Router has stored XSS via unescaped Location header in prerendered redirect HTML Also affects react-router