Remix and React Router Vulnerability CVE-2025–31137 -$$$$ BOUNTY
1 min read
Summary
The CVE-2025–31137 vulnerability affects the Remix and React Router frameworks, impacting applications that use the Express adapter.
This flaw enables attackers to manipulate the URL used in incoming requests by injecting a URL pathname into the port section of the Host or X-Forwarded-Host headers.
This can result in unauthorized redirections or access to restricted resources.
The affected versions include Remix versions 2.11.1 through 2.16.2 and React Router versions 7.0.0 to 7.4.0.
The issue has been patched in Remix version 2.16.3 and React Router version 7.4.1.
Ethical hackers and cybersecurity professionals should be aware of this vulnerability for potential exploitation, and the relevant tools and templates, such as Nuclei, can be used to detect and address such issues.