CVE-2025-43865: 
JavaScript vulnerability analysis and mitigation

React Router, a widely used router for React with approximately 14 million weekly downloads, disclosed a high-severity vulnerability (CVE-2025-43865) affecting versions on the 7.0 branch prior to version 7.5.2. The vulnerability was discovered and reported by security researchers Rachid Allam (zhero;) and Yasser Allam (inzo_), and was disclosed on April 24, 2025 (GitHub Advisory, SecurityOnline).

The vulnerability allows attackers to modify pre-rendered data by adding a specific header (X-React-Router-Prerender-Data) to the request. When exploited, this vulnerability enables complete spoofing of contents and modification of all values in the data object passed to the HTML. The vulnerability has been assigned a CVSS v3.1 base score of 8.2 (HIGH) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H (GitHub Advisory).

The vulnerability's impact is significant, particularly when a caching system is in place. It enables cache poisoning attacks where an attacker can alter all data transmitted via a loader, allowing them to modify page content at will. This can potentially lead to various exploits, including stored Cross-Site Scripting (XSS), depending on how the data is injected or used on the client-side (SecurityOnline).

The vulnerability requires the application to be running in Framework mode and the target page must use a loader. The attack can be executed by accessing the page with a .data suffix to retrieve the data object, then sending a request with the X-React-Router-Prerender-Data header containing modified values (GitHub Advisory).

The vulnerability has been patched in React Router version 7.5.2. Users are strongly advised to upgrade to this version to protect against potential attacks. No alternative workarounds have been provided (GitHub Advisory).

Cloudflare has proactively responded to the vulnerability by rolling out mitigations to protect all their customers from both CVE-2025-43865 and related vulnerability CVE-2025-43864 (SecurityOnline).