CVE-2025-43865 PoC — React Router allows pre-render data spoofing on React-Router framework mode

Source

https://github.com/pouriam23/Pre-render-data-spoofing-on-React-Router-framework-mode-CVE-2025-43865

Associated Vulnerability

Title:React Router allows pre-render data spoofing on React-Router framework mode (CVE-2025-43865)
Description:React Router is a router for React. In versions on the 7.0 branch prior to version 7.5.2, it's possible to modify pre-rendered data by adding a header to the request. This allows to completely spoof its contents and modify all the values of the data object passed to the HTML. This issue has been patched in version 7.5.2.

Readme

# Welcome to React Router!

A modern, production-ready template for building full-stack React applications using React Router.

[![Open in StackBlitz](https://developer.stackblitz.com/img/open_in_stackblitz.svg)](https://stackblitz.com/github/remix-run/react-router-templates/tree/main/default)

## Features

- 🚀 Server-side rendering
- ⚡️ Hot Module Replacement (HMR)
- 📦 Asset bundling and optimization
- 🔄 Data loading and mutations
- 🔒 TypeScript by default
- 🎉 TailwindCSS for styling
- 📖 [React Router docs](https://reactrouter.com/)

## Getting Started

### Installation

Install the dependencies:

```bash
npm install
```

### Development

Start the development server with HMR:

```bash
npm run dev
```

Your application will be available at `http://localhost:5173`.

## Building for Production

Create a production build:

```bash
npm run build
```

## Deployment

### Docker Deployment

To build and run using Docker:

```bash
docker build -t my-app .

# Run the container
docker run -p 3000:3000 my-app
```

The containerized application can be deployed to any platform that supports Docker, including:

- AWS ECS
- Google Cloud Run
- Azure Container Apps
- Digital Ocean App Platform
- Fly.io
- Railway

### DIY Deployment

If you're familiar with deploying Node applications, the built-in app server is production-ready.

Make sure to deploy the output of `npm run build`

```
├── package.json
├── package-lock.json (or pnpm-lock.yaml, or bun.lockb)
├── build/
│   ├── client/    # Static assets
│   └── server/    # Server-side code
```

## Styling

This template comes with [Tailwind CSS](https://tailwindcss.com/) already configured for a simple default starting experience. You can use whatever CSS framework you prefer.

---

Built with ❤️ using React Router.

File Snapshot


 [4.0K]  /data/pocs/28d20b2ff790f34ed14de6f9771027c089aad5ca
├── [4.0K]  app
│   ├── [ 300]  app.css
│   ├── [1.7K]  root.tsx
│   ├── [4.0K]  routes
│   │   └── [ 315]  home.tsx
│   ├── [ 134]  routes.ts
│   └── [4.0K]  welcome
│       ├── [6.0K]  logo-dark.svg
│       ├── [6.0K]  logo-light.svg
│       └── [4.1K]  welcome.tsx
├── [ 599]  Dockerfile
├── [ 814]  package.json
├── [230K]  package-lock.json
├── [4.0K]  public
│   └── [ 15K]  favicon.ico
├── [ 205]  react-router.config.ts
├── [1.8K]  README.md
├── [ 605]  tsconfig.json
└── [ 280]  vite.config.ts

4 directories, 15 files

Shenlong Bot has cached this for you

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →

Goal Reached Thanks to every supporter — we hit 100%!