HTTP Request Smuggling Affecting @react-router/express package, versions >=7.0.0 <7.4.1-pre.0
Threat Intelligence
Exploit Maturity
Snyk has a proof-of-concept or detailed explanation of how to exploit this vulnerability.
Proof of Concept
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk IDSNYK-JS-REACTROUTEREXPRESS-9598036
- published2 Apr 2025
- disclosed1 Apr 2025
- creditRachid Allam, Yasser Allam
Introduced: 1 Apr 2025
NewCVE-2025-31137 (opens in a new tab)Common Vulnerabilities and Exposures (CVE) are common identifiers for publicly known security vulnerabilities
Common Weakness Enumeration (CWE) is a category system for software weaknesses
How to fix?
Upgrade @react-router/express to version 7.4.1-pre.0 or higher.
Overview
@react-router/express is an Express server request handler for React Router
Affected versions of this package are vulnerable to HTTP Request Smuggling via Host or X-Forwarded-Host headers. An attacker can spoof the URL used in an incoming request's Host or X-Forwarded-Host header by passing in a URL pathname as the port of a URL.